This course is written by OffSec, and they provide good materials. If you enjoy their course, do not hesitate to take certification with them, as their certifications are among the most valuable on the market.

I decided to share this course for free, because there are a lot of people who would resell it, with no added value.

Enjoy, and never stop learning,

Tamarisk / @OffsecExam

Introduction to PEN-100

In this Topic, we will cover the following Learning Units:

• General Introduction to PEN-100
• How to Learn
• Introduction to Security Concepts
• Practical Help

Each learner moves at their own pace, but this Topic should take
approximately 3 hours to complete.

Welcome to PEN-100. This material will cover security fundamentals
and prepare students with the necessary prerequisites to enter into
Penetration Testing with Kali Linux (PWK),^[1] also known as
PEN-200. By completing the exercises in these Topics and by taking
the PWK course and tackling its extensive labs, students can prepare
themselves to take the Offensive Security Certified Professional
(OSCP) exam.

General Introduction to PEN-100

This Learning Unit covers the following Learning Objectives:

1. Understand some of the general concepts surrounding information security
2. Recognize the unique mindset of a successful information security
   professional
3. Understand the three pillars of prerequisite knowledge for information security

This Learning Unit will take approximately 15 minutes to complete.

PEN-100 is a learning path designed for information security
professionals at the beginning of their career, or for individuals who
might want a refresher on certain topics. The purpose of this content
is to help students become comfortable with the fundamental concepts
needed to begin a much longer journey.

Interestingly, Information Security has emerged as a unique
field and is not a sub-field or niche area of software engineering
or system administration. Consider that "regular" bugs and "security"
bugs both require development to fix, and misconfigurations can be set
straight by sysadmins.

There are a few specific properties of security that make it stand
out in a regular software development cycle. First of all, security
involves malicious and intelligent actors. The whole notion of
security exists because these bad actors may try and do something that
we would rather them not do. Notably, they are finding and exploiting
flaws to gain advantages they are not entitled to.

The problem of dealing with an intelligent opponent requires a
different approach, discipline, and mindset compared to facing a
naturally-occurring or accidental problem. Whether we are simulating
an attack or a defending against one, we will need to consider
the perspective and potential actions of our opponent, trying to
anticipate what they might do.

Another aspect of security is that it usually involves reasoning
under uncertainty. By this, we mean that when we simulate an
attack, we will never know everything there is to know about the
machine/system/network/organization we are targeting. Conversely, as
the defender, we will not be aware of every potential attack vector or
vulnerability we might be exposed to.

The problem of the intelligent adversary and the problem of
uncertainty both suggest that learning security also requires learning
more about how we think and solve problems. In particular, it
requires that we adopt and nurture specific mindsets that will help
us as we learn and apply our skills. We'll discuss more about what we
mean by mindsets later.

It's worth pausing here for a moment to consider the particular
attention that we will give to the offensive^[2] side
of security. Specifically, one might ask if an information security
professional whose primary interest and goal is defending a network,
organization, or government could focus on learning defense.

Consider for a moment the analogy of a medieval monarch building a
castle. If the monarch learns that their enemy has catapults capable
of hurling large boulders, they might design their castle to have
thicker walls. Similarly, if their enemy is equipped with ladders,
the monarch might give their troops tools to push the ladders off the
walls. The more this monarch knows about their would-be attacker and
the more they can think like an attacker, the better defense they
can build.

Similarly, in information security, we might take the role of an
attacker to better understand vulnerabilities and exposed
weaknesses. Taking on the skillsets and mindset of an attacker
allows us to better answer questions like "How might an attacker gain
access?", "What can they do with that access?", and "What are the
worst possible outcomes from an attack?".

While learning to hack is of course essential for aspiring Penetration
Testers, we also believe that defenders, security operators, and blue
teamers will greatly benefit from at least a cursory education in
offensive techniques and technologies as well.

Perhaps interestingly, the opposite can also be true. It's been our
experience that many of the best penetration testers and hackers are
those who have had extensive exposure to defending networks, building
web applications, or administrating systems.

Security is not only about understanding technology and code, but
also about understanding your own mindset and that of your adversary.
We've touched on this word, "mindset", a few times already. We tend
to think of a mindset as a set of beliefs that inform our personal
perspective.

Two contrasting examples of well-known mindsets are the fixed
mindset and the growth mindset. An individual with a fixed mindset
believes that their skill/talent/capacity to learn is what it is,
and that there is no gain to be made by trying to improve. A growth
mindset, on the other hand, purports the belief that mental ability is
flexible and adaptable, and that one can grow their capacity to learn
over time.

Research suggests that, for example, a mindset in which we believe
ourselves capable of recovering from a mistake makes us
measurably better at it.^[3] This is just one aspect of
the growth mindset, but an important one since security requires us to
make mistakes and learn from them as well as to be constantly learning
and re-evaluating.

Another extremely valuable mindset is the aptly-coined
security mindset. First proposed by security researcher Bruce
Schneier,^[4] this mindset encourages a constant
questioning of how one can attack (or defend) a system. If we can
begin to ask this question automatically when encountering a novel
idea, machine, system, network, or object, we can start noticing a
wide array of recurring patterns.

Finally, one of the most important mindsets is what we call the Try
Harder mindset. We'll talk more about what we mean by Try Harder
later, but let's quickly consider two perspectives in a moment of
"failure."

1. If my attack or defense fails, that's a truth about my current
   skills/processes/configurations as much as it is a truth about the
   system.

2. If my attack or defense fails, this allows me to learn something
   new, change my approach, and do something differently.

The most important skills to have in our toolset before we get into
hacking are not themselves necessarily security related. Knowledge
of three broad subjects tends to help students significantly with PWK,
compared to those who do not have exposure to them.

1. System Administration of Linux and Windows machines
2. Networking
3. Basic Scripting

In this learning path, we will learn the bare essentials of these
subjects. Of course, each of these is itself a full field in its own
right, so we can only cover the fundamentals.

As you go through a Topic, pay special attention to the terms
and concepts you are unfamiliar with. It will be important to do
additional research, learning, and practice to gain mastery.

Beyond simply expanding your cybersecurity vocabulary, regularly
engaging in research will help you become "comfortable with the
uncomfortable", which is core to the Try Harder philosophy. Developing
a habit of research, as well as curating your own skill as a
researcher, will be beneficial long after you finish with the material
here. To aid you with this, we've included footnotes in each Topic

How to Learn

This Learning Unit covers the following Learning Objectives:

1. Understand the basic mindset needed for this material
2. Recognize the basics of troubleshooting

This Learning Unit will take approximately 15 minutes to complete.

In our opinion, learning security is a constant journey of expanding
one's skills, knowledge, understanding of context, and mindsets. In
this section, we briefly go over some tips and tricks to make the
most out of your learning experience. We'll talk a little bit more
about the concept of Trying Hard, and also go over what we mean by
"research".

We've written^[5] before about what Try Harder means to
us. This content is designed for those who are new to security, and
so we are hoping to impart the importance of trying hard with a more
casual introduction.

Let's continue by discussing the Try Harder mindset in the specific
context of exercises. Some exercises will be easy, but it is also
reasonable to expect to encounter some difficulty. Some exercises may
require multiple steps or are otherwise not immediately simple.

Many of the exercises contain hints to help in case a student gets
stuck. Using hints comes at no cost; they are yours to use whenever
you wish. However, it's important to first notice, and then resist,
the urge to open the hint immediately.

Let's stick on this word "notice" a bit. Sometimes we can get so
absorbed in the particular challenge that we don't pay attention to
what is going on in our own heads.

In our view, it's important to take the time to notice what's
happening mentally, since this self-awareness can help us understand
our own strengths and weaknesses. If we can train ourselves to notice
bits of frustration or anxiety when something doesn't work, it makes
it easier to step back, take a breath, and evaluate what we can try
next.

You may reach a point in the course when you need to open a browser
and do a bit of research or need to ask for help. We will go over the
practical steps on how to do this shortly. In order to increase your
self-awareness and develop a growth mindset, we would encourage trying
the following the next time you either find that you don't know enough
and need to research more, or have the urge to ask for outside help.

First, notice that you are ready to ask for help, and remind yourself
that this is absolutely fine. Sometimes reaching this point can feel
like a failure, but it's important not to think of it this way.

Information security, and particularly penetration testing, is all
about not knowing things. After all, if every situation and outcome
was easily known in advance, there would be no need for penetration
testing in the first place.

Let's spend a bit more time talking about that moment when you
encounter difficulty.

It's impossible to come up with a all-encompassing solution for when
we run into trouble, but in general, we can recommend the following
two-step approach:

1. Read the output
2. Do the research

By "Read the output" we simply mean to take a moment to take stock of
the situation. Often this means reading the actual output.
Our goal in doing this is always to figure out what we need for step
two, which is "Do the research."

Let's discuss briefly how to research and study concepts that we
have not quite been mastered yet. It might seem simplistic, but one
of the most common activities during a code review, security audit, or
penetration test is googling for terms and concepts that we don't yet
understand or aren't familiar with. When searching for new terms, try
to glance through at least the first three, if not the first ten,
search results.

Sometimes the output of a program or command can be very long and
difficult to understand. In these situations, it's worth at least
reading the very first and last lines of text, because they often
contain the key information necessary to understand what is going on.

Introduction to Security Concepts

This Learning Unit covers the following Learning Objectives:

1. Understand the CIA triad and what it means
2. Understand other key terms and unique traits of this field

This Learning Unit will take approximately 15 minutes to complete.

While most of the Topics and concepts included in this learning path
are not strictly security topics, it's helpful to have a high-level
view of what we eventually want to attack and/or defend. In order to
become good attackers, we need to understand the principles defenders
should follow so that we can quickly identify when they are not
following those principles to exploit their mistakes.
Likewise, to be good defenders we will benefit from understanding how
attackers operate and what kinds of biases and errors they are prone
to.

One of the principles often used to describe the data and networks
that we are trying to secure is the CIA triad. CIA stands for
Confidentiality, Integrity, and Availability. Each of these
is a desirable property of the things we might want to secure, and
each of these three properties can be attacked. Most (though
not all) attacks against computer systems and networks will threaten
one of these notions.

A system is Confidential if the only people that can access it are
the people explicitly permitted to access it. A person's social media
account credentials are considered confidential as long as the user's
password is known only to the owner. If a hacker steals or guesses
the password and they can access the account, this would
constitute an attack against confidentiality. Common attacks against
confidentiality include network eavesdropping^[6] and
credential stuffing.^[7]

A system has Integrity if the information and functionality it
stores is only that which the owner intends to be stored. In the
above example, merely logging on to a user's social media account by
guessing their password is not an attack against integrity. However,
if the hacker starts to post messages or delete information, this
would become such an attack. A common attack against integrity is
arbitrary code execution.^[8]

A system is considered Available if the people who are supposed to
access it can do so. Again, let's consider the above scenario.
An attacker has gained access to a social media account and posted
some content of their choosing. If the attacker changes the user's
password and prevents them from logging on, this would now also be an
attack against availability. A common attack against availability is
denial of service.^[9]

Note that not all attacks are necessarily threats against all of
these principles, but many attacks can be categorized as weakening or
eliminating at least one.

An entire study could be made out of security^[10]
principles,^[11] far more than can be covered in this
introductory Topic. The rest of this section provides the high-level
descriptions of a few principles that might be encountered as you
continue this learning path.

The Principle of Least Privilege^[12] expresses the idea
that each part of a system should only be granted the lowest possible
privileges that are needed to get their job done. Whether referring to
users on a machine or lines of code in a program, correctly adhering
to this discipline can greatly narrow an attack surface.

Open Security^[13] is a somewhat counter-intuitive
principle states that the security of a system should not depend
on secrecy. In other words, even if an attacker knows exactly
how the system's security is implemented, the attacker should still
be thwarted. This isn't to say that nothing should be secret.
Credentials are a clear case where the security of a password depends
on its secrecy. However, we'd want our system to be secure even if
the attacker knows there is a password, and even if they know the
cryptographic algorithm behind it.

Defense in Depth^[14] advocates for adding defenses to as
many layers of a system as possible, so that if one is bypassed,
another may still prevent full infiltration. An example of defense in
depth outside the context of information security would be the use of
an electronic code to open a garage, followed by a bolted door lock
that can be opened with a key, followed by a voice activated
internal alarm system.

Practical Help

This Learning Unit covers the following Learning Objectives:

1. Understand the basic tools available to students
2. Understand how to be "hands-on" with the material
3. Understand how to connect to the VPN
4. Understand how to complete exercises

This Learning Unit will take approximately 120 minutes to complete.

In this section, we'll cover how to connect to the lab environment,
start lab machines, and complete exercises.

The structure of each Topic is relatively straight forward. We
introduce each Learning Unit with a text-based explanation and
highlight some of the most important concepts and ideas. As mentioned
above, many of the technical terms have footnotes to help
supplement the student's learning.

Throughout each Topic, you will find several Learning Units. Most
Learning Units have exercises. These exercises come in two basic
forms.

Some exercises require only that you recall or research an answer
to a particular question. For example, you might be asked "What
networking protocol is often used to transfer files from one machine
to another?", and the solution would be "FTP".

The second kind of exercise requires you to perform some action on
a machine. You will need to retrieve information or a "flag", and
input it as the answer to the exercise. The format of flags is usually
(though not always) "OS{InsertFlagValueHere}".

An example of this kind of exercise would be "Log on to the
machine at 192.168.21.3 and retrieve the flag from the user Adam's
desktop." Once you've followed these steps, you will find a flag
file, perhaps called flag.txt, which will contain the flag
in text format: "OS{InsertFlagValueHere}".

Active learning, which will require you to perform many of the actions
that you are reading about, is much more effective as a way to learn
content than simply repeating it back. This application of skills and
practice is key to OffSec's methodology.

We want to encourage you not to give up on tough exercises! Some may
be challenging at first, but all the information needed to complete
them is either in the Topic itself or available via the linked
resources.

For a given exercise or set of exercises, the machine can be started
via the web interface. There are two ways to interact with the lab
machines: the web-based Kali Virtual Machine (VM), and the lab Virtual
Private Network (VPN).

The web-based Kali VM allows quick and efficient access to the lab
machines, without having to download or configure any files locally.
First, click the Connect to Kali button at the top right corner of
the web page. Then, when a particular exercise requires it, click the
My Kali button at the top left corner of the web page, and a new
Kali VM will deploy right in your browser. From this Kali machine, you
will be able to start and connect to all the machines associated with
the Learning Unit exercises.

Alternatively, you can connect to the lab VPN network via your
own local Kali VM. The VMware image that we provide for your use
throughout PEN-100 is a default 64-bit build of Kali Linux. We
recommended that you download and use the latest VMware image
available on the Offensive Security VM image download page.^[15]
While you are free to use the VirtualBox or Hyper-V image or even your
own Kali installation, we can only provide support for the provided
VMware image. These images are provided courtesy of Offensive Security
and are not supported by the Kali Linux project team.

The Networking Fundamentals Topic covers what a VPN is in more depth.
For this introduction, we will focus only on the practical task of
connecting to it.

In order to complete some of the exercises and work with the content,
we will need to connect to a VPN. Some of these steps may be a bit
daunting, but we will do our best to make it simple and easy. There
are a few ways to do this, but we'll walk through one particular
method here.

First, we will need to make sure that we are accessing this learning
portal (where you are viewing this content) from a local Kali Linux
Virtual Machine.

A virtual machine^[16], or VM, is somewhat like having a second
computer, perhaps with a different operating system and a different
set of tools, at our disposal. We'll need some software to allow us to
do this (there are several free options available).

Once we have a virtual machine setup with Kali Linux^[17] on
it, we're ready for the next step. Kali Linux is an operating system
(like Windows or macOS) that comes with a specific set of tools that
are specifically useful for information security activities. Since it
is open source, Kali Linux is free to use.

Let's pause for a moment and review terminology briefly. For this
example, let's say we are sitting at a desk with a MacBook. We have
installed VMware Fusion (the software that makes the VM possible) and
the VM is running Kali Linux. In this case the MacBook is our "host
machine" and Kali is our "local VM." Finally, you have accessed the
material you are reading right now in a browser. We'll call this
content "the portal."

It is important to note that different virtualization software exist
and the host needs to be considered when choosing virtualization
software. Please be sure to look at which software is
appropriate for your host. We will be using a MacBook, which is the
reason VMware Fusion is used in our scenario.

We also have an in-browser instance of Kali Linux available for our
convenience, but to keep this topic simplified and more accessible
(even outside the Offensive Security environments), we will cover a
local virtual machine installation to connect to our VPN.

It will be important for you to access the portal (where you are
viewing this content now) from your local VM.

Note that if you try and access the portal from your host machine and
do the VPN connection from your local VM, it won't work as expected.

Once you've connected to the portal from your local VM, you'll need to
connect to to the VPN. To do this, you'll want to access the main page
and click Download VPN at the top right of the web interface. Your
browser will download a text file with the extension .ovpn.

Some of the steps we follow here rely on concepts that will we will
teach in other Topics. If you are unable to connect to the VPN after
reading these instructions, try reading the Linux Basics Topics first.

The first step to connect to the VPN requires that we start our Kali
Linux terminal. Click the black terminal icon at the top left of the
Kali VM. A screen should appear that looks like this:

┌──(kali㉿kali)-[~]
└─$   
Copy

Listing 1 - The kali terminal

If we chose a different username during setup, our screen might look a
bit different.

┌──(ArtVandelay㉿kali)-[~]
└─$   
Copy

Listing 2 - The kali terminal with a different username

There may be times when things in this guide might appear slightly
different from things on your local VM. It's good to notice these
details. We'll do our best to point out when and how these differences
might appear.

The visible text here makes up the command prompt, which we can use to
type text into the terminal. While the default Kali terminal is fancy
and helps to buffer input from output, we will be using a more
simple command prompt to avoid clutter. We can switch command prompts
from the two-line version in Listing 1 to a one-line
version with the C+p shortcut.

kali@kali:~$ 
Copy

Listing 3 - Switching to the one-line command prompt

The next thing we need to do is find where our VPN pack (i.e. the
.ovpn file) we downloaded is on the VM. If you downloaded
the VPN pack on your host machine, you will need to either move it to
your local VM, or redownload it directly via the VM. We'll use a pair
of commands called updatedb and locate to find the
file.

For this example we are using the filename fundamentals.ovpn. Make
sure to check your browser's download history to get the exact name of
the file.

kali@kali:~$ sudo updatedb
[sudo] password for kali:

kali@kali:~$ locate fundamentals.ovpn
/home/kali/offsec/fundamentals.ovpn

kali@kali:~$ 
Copy

Listing 4 - Finding the .ovpn file

In Listing 4, we use the sudo command
to invoke updatedb, because this particular command requires
elevated permissions. We'll learn more about sudo and permissions
in the Linux Basics Topics. The sudo command may require us to enter our
password. As we are typing, the cursor will not move and no asterisk
(*) characters will appear. We'll type in our password and press
I.

Once we have located the .ovpn file, we need to move to the
directory it is inside of with the cd command. After cd, we
entered in the value highlighted in Listing 4.

kali@kali:~$ cd /home/kali/offsec          
kali@kali:~/offsec$ 
Copy

Listing 5 - Changing Directories with cd

While we don't see any output from this command, we can check for the
existence of the .ovpn file with the ls command,
which lists files in this directory.

kali@kali:~/offsec$ ls
fundamentals.ovpn

kali@kali:~/offsec$
Copy

Listing 6 - Listing file contents with ls

Excellent! We are now ready to connect to the VPN with the openvpn
command. To connect to the labs VPN, we invoke openvpn and
then the full name of the .ovpn file. Once again we must
use sudo first, because openvpn also requires elevated
permissions. If we've done this just a few short minutes after the
previous sudo command, we shouldn't need to enter our password again.
If, on the other hand, it's been a while, we might receive a password
prompt.

kali@kali:~/offsec$ sudo openvpn fundamentals.ovpn 
2021-06-28 10:20:12 Note: Treating option '--ncp-ciphers' as  '--data-ciphers' (renamed in OpenVPN 2.5).
2021-06-28 10:20:12 DEPRECATED OPTION: --cipher set to 'AES-128-CBC' but missing in --data-ciphers (AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add 'AES-128-CBC' to --data-ciphers or change --cipher 'AES-128-CBC' to --data-ciphers-fallback 'AES-128-CBC' to silence this warning.
2021-06-28 10:20:12 OpenVPN 2.5.1 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on May 14 2021
2021-06-28 10:20:12 library versions: OpenSSL 1.1.1k  25 Mar 2021, LZO 2.10
2021-06-28 10:20:12 TCP/UDP: Preserving recently used remote address: [AF_INET]192.95.19.165:1194
2021-06-28 10:20:12 UDP link local: (not bound)
2021-06-28 10:20:12 UDP link remote: [AF_INET]192.95.19.165:1194
2021-06-28 10:20:12 [offensive-security.com] Peer Connection Initiated with [AF_INET]192.95.19.165:1194
2021-06-28 10:20:13 TUN/TAP device tun0 opened
2021-06-28 10:20:13 net_iface_mtu_set: mtu 1500 for tun0
2021-06-28 10:20:13 net_iface_up: set tun0 up
2021-06-28 10:20:13 net_addr_v4_add: 192.168.49.115/24 dev tun0
2021-06-28 10:20:13 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2021-06-28 10:20:13 Initialization Sequence Completed
Copy

Listing 7 - Connecting to the labs VPN

The output of Listing 7 may seem intimidating at
first, and we'll learn more about how to interpret much of this output
in later Topics. For now, note that the last line of the output says
"Initialization Sequence Completed" - this indicates that we have
connected successfully to the VPN.

We need to leave the terminal window running the VPN connection
open. To continue working with the command line, we will open another
terminal window. We can do this by clicking File and then clicking
New Window.

After the new window is open, we can move the VPN terminal window out
of the way and ignore it until we are finished. Do not close the VPN
terminal window. Closing it will disconnect the VPN connection.

Now that we are connected to the VPN and have a terminal window ready
to work with, we will return to the portal. Then we'll need to click
the play button next to the exercise host VM. This will take a
little bit of time to start (a countdown should be visible next to the
name of the machine). Once it is started, an IP address will be shown
for that exercise host.

If a host can be connected to via SSH^[18], we can use the
ssh command after connecting to the VPN. This connection
will have to be initiated from a separate terminal window than the VPN
connection. When the exercise host is started, the IP address for that
host will be shown. As described previously, we will click the play
button to start the exercise host.

We can use the IP address and the supplied information in the
exercises to gain access to the machine. In the following example,
the IP of the exercise host is 192.168.50.18, but it will likely
be slightly different in your case. The exercise VM IP address will
change based on user activity and the machine IP generation process.
Since we are already connected to the VPN as previously described,
let's go ahead and use ssh to connect to the exercise
machine.

kali@kali:~$ ssh atlas@192.168.50.18
The authenticity of host '192.168.50.18 (192.168.50.18)' can't be established.
ECDSA key fingerprint is SHA256:b8kEbLgPOJQUid4sdWv2g7ZMK1K1VKUKKFwx6ysCoCw.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.50.18' (ECDSA) to the list of known hosts.
altas@192.168.50.18's password: 
Welcome to Ubuntu 20.04.2 LTS (GNU/Linux 5.4.0-81-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

  System information as of Mon 16 Aug 2021 06:47:25 PM UTC

  System load:                      0.0
  Usage of /:                       64.0% of 9.78GB
  Memory usage:                     33%
  Swap usage:                       0%
  Processes:                        221
  Users logged in:                  1
  IPv4 address for br-58d27e3e88ac: 10.0.0.1
  IPv4 address for docker0:         172.17.0.1
  IPv4 address for ens160:          192.168.50.18

 * Super-optimized for small spaces - read how we shrank the memory
   footprint of MicroK8s to make it the smallest full K8s around.

   https://ubuntu.com/blog/microk8s-memory-optimisation

0 updates can be applied immediately.


Last login: Mon Aug 16 17:44:51 2021 from 192.168.48.4
atlas@linux01:~# 
Copy

Listing 8 - An SSH connection is established with the exercise host

Let's explore this command a bit. The complete command we ran was
ssh atlas@192.168.50.18. The first part, ssh is a
program that helps us setup a connection to another machine. The next
part, atlas in this case, is the username. The last part is
the IP address we found on the portal after we started the machine.

Once we hit return, we are asked if we are sure we want to connect. We
typed in yes and hit return again.

Finally, we were prompted for the user's password. We'll want to
keep this in mind. When connecting via ssh, we will often (though not
always) need a set of "credentials" which is the username and password
pair. These should be provided in the portal. Different users have
different permissions on a system, so if we want to log into a machine
as a different user, we'll close this ssh session and open a new
one, this time using the new username. As before, when we type in the
password, no text or asterisks (*) appear.

Note that our prompt changed from kali@kali:~$ and now reads
altas@linux01:~#. This indicates that we are now connected, and
any commands we type into the terminal will be executed on the machine
we are connected to. If we ssh into a Windows machine, the prompt will
change as well.

Some students who use ssh for the first time may expect something like
a new window showing a remote desktop. This will be the case when we
are using the rdesktop utility, but ssh is a preferred method
of connection for a variety of reasons.

Once we have connected we can complete the exercises for a particular
section.

When we are finished with the exercise host, we can disconnect from
ssh by entering exit. This will send us back to our original Kali
terminal prompt. Let's do this now.

atlas@linux01:~# exit
logout
Connection to 192.168.50.18 closed.
                                                                             
kali@kali:~$
Copy

Listing 9 - The SSH connection is closed

After disconnecting from the exercise host, we will want to click the
stop button in the portal to shut the exercise host down. If the
exercise host isn't stopped after we are finished with it, it may
cause conflicts with starting and completing other exercises as we
move forward.

Some exercises may have us connect to a machine via the
rdesktop command. When and where this is the case, we will
walk through this connection within the exercise.

When we are finished with the lab, we will disconnect from the
VPN. This is done by opening the terminal window where the VPN
connection was established. Within this window, we will press
C+c. Let's go ahead and disconnect our VPN session
now.

kali@kali:~/offsec$ sudo openvpn fundamentals.ovpn
2021-08-17 10:41:23 Note: Treating option '--ncp-ciphers' as  '--data-ciphers' (renamed in OpenVPN 2.5).
2021-08-17 10:41:23 DEPRECATED OPTION: --cipher set to 'AES-128-CBC' but missing in --data-ciphers (AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add 'AES-128-CBC' to --data-ciphers or change --cipher 'AES-128-CBC' to --data-ciphers-fallback 'AES-128-CBC' to silence this warning.
2021-08-17 10:41:23 OpenVPN 2.5.1 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on May 14 2021
2021-08-17 10:41:23 library versions: OpenSSL 1.1.1k  25 Mar 2021, LZO 2.10
2021-08-17 10:41:24 TCP/UDP: Preserving recently used remote address: [AF_INET]54.236.130.76:1194
2021-08-17 10:41:24 UDP link local: (not bound)
2021-08-17 10:41:24 UDP link remote: [AF_INET]54.236.130.76:1194
2021-08-17 10:41:24 [offensive-security.com] Peer Connection Initiated with [AF_INET]54.236.130.76:1194
2021-08-17 10:41:25 TUN/TAP device tun0 opened
2021-08-17 10:41:25 net_iface_mtu_set: mtu 1500 for tun0
2021-08-17 10:41:25 net_iface_up: set tun0 up
2021-08-17 10:41:25 net_addr_v4_add: 192.168.49.60/24 dev tun0
2021-08-17 10:41:25 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2021-08-17 10:41:25 Initialization Sequence Completed
^C2021-08-17 10:41:30 event_wait : Interrupted system call (code=4)
2021-08-17 10:41:30 SIGTERM received, sending exit notification to peer
2021-08-17 10:41:31 net_addr_v4_del: 192.168.49.60 dev tun0
2021-08-17 10:41:31 SIGTERM[soft,exit-with-notification] received, process exiting

kali@kali:~/Downloads$ 
Copy

Listing 10 - The VPN is now disconnected

It is important to disconnect from the VPN when we are finished to
avoid any connection issues from leaving it running in the background.

Finally let's put what we've learned into practice and learn how to
complete the exercises that will appear here.

We recommend that you fully complete the exercises at the end of
each section before moving on to the next one. They will test your
understanding of the material and build your confidence to move
forward.

The time and effort it takes to complete these exercises may depend on
your existing skillset. Please note that some exercises are difficult
and may take a significant amount of time. We want to encourage
you to be persistent, especially with tougher exercises. They are
particularly helpful in developing the "Try Harder" mindset.

Please note that the IP addresses presented in the Learning Units do
not necessarily reflect the IP addresses in the Offensive Security
lab. Do not try to copy the examples in the lab guide verbatim. You
will need to adapt the examples to your specific lab configuration.
The specific IP address of each machine you deploy will be shown
inside the web portal UI.

The lab you are connecting to is uniquely allocated to you, as long
as you are using it. This allows each student to work at their pace
without worrying about interrupting or being interrupted by other
students.

Even though each lab is private, it is important to consider the
labs as a hostile environment and you should not store sensitive
information on the Kali Linux virtual machine used to connect to the
labs. Student-to-student VPN traffic is not allowed; however, you can
help protect yourself by stopping services when they are not being
used and by making sure any default passwords have been changed on
your Kali Linux system.

We hope that you have acquired a good sense of how to proceed
throughout this Learning Path. While most of the Topics are designed
to stand on their own, we recommend beginning with the Linux Basics,
Windows Basics, Networking and Scripting Topics in that order. As
described above, we believe that these fundamental areas represent
the most important pre-requisites for an aspiring cybersecurity
professional. Should you already have experience in these areas, you
are welcome to move on to any Topic that captures your interest. We
wish you the best of success in your Learning Journey!

Linux Basics I

In this Module, we will cover the following Learning Units:

• Introduction to Linux
• Command-Line Basics
• Manuals and Help
• The Linux Filesystem
• The Environment
• Linux File Management
• Piping and Redirection
• Search and Text Manipulation

Each learner moves at their own pace, but this Module should take
approximately 10 hours to complete.

Although Linux represents a relatively small proportion of the desktop
operating system market share, it is one of the most stable operating
systems. This is in part because it is open-source and employs
unique collaborative development techniques by the community. A new
kernel/core is released every 2-3 months.

Since many of the common tools used by penetration testers and
security professionals are often built for a Linux environment,
we'll need to make sure we're familiar with Linux. Eventually, we may
need to use these tools and we won't want to worry about dependencies
or porting programs to other operating systems.

Introduction to Linux

This Learning Unit covers the following Learning Objectives:

1. Understand what Linux is
2. Describe the origins of the Linux kernel
3. Understand the concept of Linux distributions
4. Describe what Kali Linux is

This Learning Unit will take approximately 60 minutes to complete

To have a good grasp of Linux concepts and to begin getting
hands-on with the operating system, we will first introduce the
following topics.

The Linux History^[19] section will briefly discuss
how the Linux operating system came into existence and how it is
maintained.

The Linux Operating Systems section will cover the different
distributions of Linux that are available and what makes them
different from each other.

In the Kali Linux section, we will introduce Kali Linux and why
it is one of the most popular penetration testing distributions, what
it offers, and how it can be useful for us throughout an assessment.

The term Linux is sometimes used to refer to a family of open-source
operating systems, but it is perhaps more accurate to use this term
to describe a kernel,^[20] which is the base of those
operating systems.

The main functions of the Linux kernel are to manage peripheral
devices, handle communication with the processor and memory, schedule
tasks to be executed, handle interrupt requests, and so on.

Linux is a Unix-like operating system kernel. Unix was a popular
commercial product in the 1970s and 1980s, and it influenced the
design of several other later systems. One of the systems that
was influenced by Unix was called Minix.^[21] Minix was created
by Andrew S. Tanenbaum for educational purposes. Tanenbaum made its
complete source code available to universities for study in courses
and research.

One Finnish university student, Linus Torvalds, had used Minix but
wanted to deviate from its existing architecture. Torvalds decided
to develop his own monolithic kernel (Minix had a microkernel
architecture).

In a microkernel^[22] architecture, the kernel is
broken down into separate processes, known as servers. Some of the
servers run in kernel-space and some run in user-space. All servers
are kept separate and run in different address spaces. Servers invoke
"services" from each other by sending messages via Inter-Process
Communication (IPC). This separation has the advantage that if one
server fails, other servers can still work efficiently.

A monolithic kernel, on the other hand, is one large process running
entirely in a single address space. It is a single, static, binary
file. All kernel services exist and execute in the kernel address
space and the kernel can invoke functions directly.

Around the same time that Torvalds was working on his monolithic
kernel, the GNU project was preparing to offer a free Unix-like
operating system that included a collection of free software programs
like system utilities, text editors, and others.

GNU developers started to develop a kernel called Hurd,^[23] which
was based on the microkernel design. When the Linux kernel became
production-ready earlier than expected, the project decided to choose
Linux as the kernel for the GNU operating system. The term GNU/Linux
refers to the GNU operating system using the Linux kernel.

The integration of the kernel, the operating system, system utilities,
and other software packages is called a distribution. When we use
the term distribution, we are referring to a working system that can
be installed, boots itself, and provides additional software.

One thing we need to understand is that Linux is not an operating
system, it is just a kernel and it is the core used by other
distributions and operating systems. This means that a kernel on its
own is only as usable as a car engine without the surrounding car.

If we were to search online for Linux operating systems, we would
find many of them, each optimized for specific tasks. For example,
one Linux distribution may be optimized for command-line use, while
another is best suited for a completely different application. There
are graphical desktop versions of a Linux-based operating system that
may not make sense to use on a server where someone only needs the
command-line to accomplish certain tasks.

Although Ubuntu^[24] is one of the most popular Linux-based
OSs, there exist a lot more such as Knoppix, CentOS, SUSE, Gentoo,
Android, and OpenWrt.

In broad terms, Linux distributions may be created, described, and
categorized as any of the following.

• Commercial or non-commercial

• Designed for enterprise users, power users, or home users

• Supported on multiple types of hardware, or platform-specific

• Designed for servers, desktops, or embedded devices

• General purpose or highly specialized toward specific machine
  functionalities

• Targeted at specific user groups

• Built primarily for security, usability, portability, or
  comprehensiveness

• Have standard release cycles or rolling releases.

To conclude, different Linux-based operating systems are better
suited for different tasks. The software is open source - any user
with sufficient knowledge and interest can customize an existing
distribution or design one to suit their own needs.

Kali Linux is a Debian-based Linux distribution created by OffSec in
early 2013 and geared towards various information security tasks, such
as Penetration Testing, Security Research, Computer Forensics, and
Reverse Engineering.

The distribution contains a suite of information security tools
constantly updated serving different purposes such as information
gathering, vulnerability analysis, wireless attacks, web application
attacks, exploitation tools, password attacks, hardware hacking,
sniffing or spoofing, and so on.

Kali Linux users can review the free online training available as
PEN-103 in the Offsec Training Library. This includes the Kali Linux
Revealed book and exercises designed to test your understanding. These
free resources are useful to users of all skill levels and will help
you get a jump start into getting familiar with the distribution.

Command Line Basics

This Learning Unit covers the following Learning Objectives:

1. Understand what a shell is
2. Perform basic navigation in a Linux shell
3. List the contents of a directory via the command-line
4. Read the contents of a file via the command-line

This Learning Unit will take approximately 120 minutes to complete.

One of the most common ways to interact with a Linux-based system is
via the command-line.^[25] A command-line is a text-based
interface that allows for information queries or code execution. We
can start using a command-line by opening up a terminal.

In Kali Linux, we can open up a terminal by clicking on the black icon
on the top left in the top bar. Once we do so, we get a new window
with something similar to the following.

┌──(kali@kali)-[~]
└─$ 
Copy

Listing 1 - The Kali terminal

Each user will have their own preferences for how to use the terminal.
For the remainder of these course materials, we will be using a
slightly different view. To toggle between views, we can use the
C+p shortcut.

kali@kali:~$
Copy

Listing 2 - An alternative view of the command-line

One commonly-used name to refer to the command-line or the terminal is
a shell. Technically speaking, a shell is a program that processes
commands and returns output - but it is also colloquially used as a
synonym for the terminal or console.

There are a few important shells on Linux:

• sh: The Bourne SHell is the foundation for almost all other
  shell environments, since it holds the most important tasks, which
  have to do with command interpretation or act as a scripting language.

• Bash: Also known as Bourne-Again SHell, Bash was developed
  to serve as a replacement for Bourne SHell by offering additional
  functionality and better syntax.^[26] Bash is the default
  login shell for most Linux distributions.

• ksh: This is another variation of a shell environment called
  Korn SHell, which again adds some functionality to the basic sh and
  Bash. For example, ksh handles the loop syntax better than Bash.

• zsh: The Z SHell is an extended Bourne SHell with additional
  improvements and functionality, which also builds on top of some of
  the Bash ones.

Different shell environments serve the same basic purpose of
running programs and interpreting commands, but they offer different
functionality that might better facilitate various tasks.

Linux does not use Windows-style drive letters.^[27]
Instead, all files, folders, and devices are children of the root
directory, represented by the forward slash (/) character.

The pwd command will print the current directory (which is
helpful if we get lost) and we can use the cd command to move
from one directory to another. Running "cd <directory_name>" will
take us inside of "<directory_name>" within the current folder, if
it exists.

Let's try maneuvering around some directories.

kali@kali:~$ pwd
/home/kali

kali@kali:~$ cd Documents

kali@kali:~/Documents$ pwd
/home/kali/Documents

kali@kali:~/Documents$ cd doesnotexist
cd: no such file or directory: /doesnotexist

kali@kali:~/Documents$
Copy

Listing 3 - Changing directories.

Here we use pwd to show the current directory and then
cd to move into the Documents directory. We're
unable to move into the doesnotexist directory because, this
made up directory, it does not exist.

To move up one directory, we can use cd with two periods, to
indicate the directory above the one we are currently in.

Let's do that now to return to the /home/kali directory.

kali@kali:~/Documents$ cd ..

kali@kali:~$ pwd
/home/kali

kali@kali:~$
Copy

Listing 3 - Changing directories.

While we are beginning to understand directories, we need to note that
we can refer to files and directories in two different ways. We can
refer to their location with either an absolute path or a relative
path.

An absolute path is used to reference a file or directory starting
with the root directory (/). For example, if we would like
to print the contents of the passwd file, which exists inside
etc/ that is in the root directory /, then we can
reference it using /etc/passwd. We can do this no matter what
the current directory is.

kali@kali:~/Documents/drafts/$ file /etc/passwd
/etc/passwd: ASCII text

kali@kali:~/Documents/drafts/$ cd ~

kali@kali:~$ file /etc/passwd
/etc/passwd: ASCII text
Copy

Listing 4 - Referencing a file using its absolute path.

Here, we ran the same command, which checks what type of
file passwd is, twice. We ran it once from the
/Documents/drafts folder and once from the "root" folder.
Because we used an absolute path, the results are the same.

A relative path, on the other hand, is a location relative to our
current working directory. As we change locations and move from one
directory to another, the relative path will also change. In order
to address the same passwd file in a relative directory path
format, we need to first know our current working directory. We can
run pwd again for that information.

kali@kali:~$ pwd
/home/kali
Copy

Listing 5 - Current directory.

Currently, we are inside the "root" directory (/home/kali).
The passwd file is inside the /etc folder. To
get to it, we will need to go two directories "up" from our current
directory and then into the /etc folder. We can reference
the file using ../../etc/passwd. The two periods (..)
represent the directory one level up from our current location, so
../../ means we are moving two directories up.

kali@kali:~$ file ../../etc/passwd
/etc/passwd: ASCII text

kali@kali:~$ cd Documents

kali@kali:~/Documents$ file ../../etc/passwd
../../etc/passwd: cannot open `../../etc/passwd' (No such file or directory)

Copy

Listing 6 - Referencing a file using its relative path.

Once again, we're running the same command twice. The first time
it is successful, but when we change locations and then run it from a
new location, Kali can't find the file and we get different results.

One useful feature about shell environments is that they store the
current user home directory path (if it is set), and we can easily
reference it using the tilde (~) symbol. This means that if we are
inside any directory and we want to quickly jump back to our home
directory, we could use cd ~. We've done this already in
Listing 4, but let's practice it one more time.

kali@kali:/etc$ pwd
/etc

kali@kali:/etc$ cd ~

kali@kali:~$ pwd
/home/kali
Copy

Listing 7 - Referencing the home directory using ~.

The ls command prints out a basic file listing to the screen.
We can also add options after a command to change its output or how it
functions. For example, the -1 option displays each file on
its own single line, which can be very useful for automation.

kali@kali:~$ ls
Desktop  Documents  Downloads  Music  Pictures  Public  Templates  Videos

kali@kali:~$ ls /etc/apache2/sites-available/*.conf
/etc/apache2/sites-available/000-default.conf
/etc/apache2/sites-available/default-ssl.conf

kali@kali:~$ ls -1
.
..
Desktop
file1
file2
Directory1
...
Copy

Listing 8 - Listing files.

The output includes a combination of files and folders
named Desktop, file1, etc.

Another common option with ls is the -la option,
which uses a long listing format and includes all files, even hidden
ones.

kali@kali:~$ ls -la
total 120
drwxr-xr-x 14 kali kali 4096 Jun 23 15:47 .
drwxr-xr-x  3 root root 4096 Jun 23 15:07 ..
-rw-r--r--  1 kali kali 220 Jun 23 15:07 .bash_logout
-rw-r--r--  1 kali kali 5349 Jun 23 15:07 .bashrc
-rw-r--r--  1 kali kali 3526 Jun 23 15:07 .bashrc.original
drwxr-xr-x  6 kali kali 4096 Jun 23 15:09 .cache
drwx------  8 kali kali 4096 Jun 23 15:09 .config
drwxr-xr-x  2 kali kali 4096 Jun 23 15:09 Desktop
-rw-r--r--  1 kali kali   55 Jun 23 15:47 .dmrc
drwxr-xr-x  2 kali kali 4096 Jun 23 15:09 Documents
drwxr-xr-x  2 kali kali 4096 Jun 23 15:09 Downloads
...
Copy

Listing 9 - Listing files with options.

There are additional options that we can use with ls and there are
several resources^[28] that explore this in further detail. Linux also
includes a manual for this command and others. We will cover how to
find and explore these later.

There are several commands that can be used to print the content of
a given file to the screen. We can use cat, more,
less, head, and tail to output text to the
terminal. It's useful to be familiar with all of them, since each one
can be useful in different contexts.

The cat program allows us to read a file's content,
and it offers some useful options to filter output. For example,
the -n option will output the file's content as well as
demonstrate the file's number lines.

kali@kali:~$ cat file
this
is
a
file
that
has
many 
lines

kali@kali:~$ cat -n file
     1  this
     2  is
     3  a
     4  file
     5  that
     6  has
     7  many 
     8  lines
Copy

Listing 10 - Concatenating files with and without -n.

more is a simple program that is used to view text files at
the command prompt, displaying one screen at a time if the file is
large.

less is actually a complete version of more, with
more options. It allows navigation both forward and backward through
the file. The +F option tells less to watch the file
contents for changes. This can be useful when monitoring log files,
for example.

head allows us to print the top N number of lines from a
file. For example, if we wanted to only display the first three lines
of a file then we could do so using head -n 3 file.txt. We
might do this when looking at configuration files where we know we're
interested in only the top lines.

tail is just the opposite. It prints out the last N lines
of a file. We often can use tail to output log files. The syntax is
similar to that of head, tail -n 3 file.txt. Since logs get
written to with the most recent events at the bottom, tail can give us
a quick idea of what is going on.

Manuals and Help

This Learning Unit covers the following Learning Objectives:

1. Execute man pages in Linux to learn more about a command
2. Utilize different man pages aside from the default
3. Invoke -h or --help

This Learning Unit will take approximately 45 minutes to complete.

Many Linux programs have built in manuals, also known as man
pages. We can use the man command to open up a man
page in our terminal window. Generally, each man page will have a
name, a synopsis, a description of the command's purpose, and the
corresponding options, parameters, or switches.

For example, we can open the man page for ls with the
following command:

kali@kali:~$ man ls
LS(1)             User Commands           LS(1)

NAME
       ls - list directory contents

SYNOPSIS
       ls [OPTION]... [FILE]...

DESCRIPTION
       List information about the FILEs (the current directory by default).
       Sort entries alphabetically if none of -cftuvSUX nor --sort is
       specified.

       Mandatory arguments to long options are mandatory for short options too.

       -a, --all
              do not ignore entries starting with .

       -A, --almost-all
              do not list implied . and ..

       --author
              with -l, print the author of each file

       -b, --escape
              print C-style escapes for nongraphic characters

       --block-size=SIZE
              with -l, scale sizes by SIZE when printing them; e.g., '--block-size=M'; see SIZE format below

       -B, --ignore-backups
              do not list implied entries ending with ~
...
Copy

Listing 11 - Viewing the manual for ls

Man pages contain information about user commands, and also
documentation regarding system administration commands, programming
interfaces, and more. Manuals are categorized by several numbered
sections.

Table 1 - man page organization

To determine the appropriate manual section, we can perform a keyword
search. For example, let's assume we are interested in learning a
bit more about the file format of the /etc/passwd file.
Typing man passwd at the command-line will show information
regarding the passwd command from section 1 of the manual,
which is not what we are interested in.

kali@kali:~$ man passwd
PASSWD(1)               User Commands               PASSWD(1)

NAME
       passwd - change user password

SYNOPSIS
       passwd [options] [LOGIN]

DESCRIPTION
       The passwd command changes passwords for user
       accounts. A normal user may only change the password
       for their own account, while the superuser may change
       the password for any account.  passwd also changes the
       account or associated password validity period.
...
Copy

Listing 12 - Attempting to find information on /etc/passwd

However, if we use the -k option with man, we can
perform a keyword search as shown below.

kali@kali:~$ man -k passwd
chgpasswd (8)        - update group passwords in batch mode
chpasswd (8)         - update passwords in batch mode
exim4_passwd (5)     - Files in use by the Debian exim4 packages
exim4_passwd_client (5) - Files in use by the Debian exim4 packages
expect_mkpasswd (1)  - generate new password, optionally apply it to a user
fgetpwent_r (3)      - get passwd file entry reentrantly
getpwent_r (3)       - get passwd file entry reentrantly
gpasswd (1)          - administer /etc/group and /etc/gshadow
grub-mkpasswd-pbkdf2 (1) - generate hashed password for GRUB
htpasswd (1)         - Manage user files for basic authentication
...
Copy

Listing 13 - Performing a passwd keyword search with man

We can narrow the search with the help of a regular expression.

kali@kali:~$ man -k '^passwd$'
passwd (1)           - change user password
passwd (1ssl)        - compute password hashes
passwd (5)           - the password file
Copy

Listing 14 - Narrowing down our search

In this command, the regular expression is enclosed by a caret
(^) and dollar sign ($), to match the entire line
and avoid sub-string matches.

From the results we notice that the content we're searching for is in
section 5 of the passwd man page. We can execute the man
command again, this time referencing the appropriate section.

kali@kali:~$ man 5 passwd
PASSWD(5)        File Formats and Conversions       PASSWD(5)

NAME
       passwd - the password file

DESCRIPTION
       /etc/passwd contains one line for each user account,
       with seven fields delimited by colons (“:”). These
       fields are:

       •   login name

       •   optional encrypted password

       •   numerical user ID

       •   numerical group ID

       •   user name or comment field

       •   user home directory

       •   optional user command interpreter
...
Copy

Listing 15 - Using man to look at the
manual page of the /etc/passwd file format

Man pages are typically the quickest way to find detailed
documentation on a given command. Sometimes we're simply interested
in getting a basic understanding of how to use a command. For this
reason, many Linux commands include a -h or --help option that
displays the command's usage, or help information.

kali@kali:~$ more -h     

Usage:
 more [options] <file>...

A file perusal filter for CRT viewing.

Options:
 -d, --silent          display help instead of ringing bell
 -f, --logical         count logical rather than screen lines
 -l, --no-pause        suppress pause after form feed
 -c, --print-over      do not scroll, display text and clean line ends
 -p, --clean-print     do not scroll, clean screen and display text
 -s, --squeeze         squeeze multiple blank lines into one
 -u, --plain           suppress underlining and bold
 -n, --lines <number>  the number of lines per screenful
 -<number>             same as --lines
 +<number>             display file beginning from line number
 +/<pattern>           display file beginning from pattern match

 -h, --help            display this help
 -V, --version         display version

For more details see more(1).                                                          
Copy

Listing 16 - Viewing the help info for more

In Listing 16, we use the -h option to view all
of more's options.

The Linux Filesystem

This Learning Unit covers the following Learning Objectives:

1. Understand the Linux Filesystem Hierarchy Standard (FHS)
2. Recall where important system configuration files are stored
3. Recall where important user files are stored

This Learning Unit will take approximately 60 minutes to complete.

Since there are many distributions and flavors of Linux, the Linux
Foundation has developed a standard called the Filesystem Hierarchy
Standard (FHS).^[29] The FHS exists so that when users
interact with an unfamiliar Linux environment, they can still find
their way around the machine.

The FHS defines the purpose of each main directory on a Linux system.
The top-level directories are described as follows.

• /bin/: basic programs

• /boot/: Linux kernel and other files required for its early
  boot process

• /dev/: device files

• /etc/: configuration files

• /home/: user's personal files

• /lib/: basic libraries

• /media/: mount points for removable devices (CD/DVD-ROM,
  USB keys, and so on)

• /mnt/ or /mount/: temporary mount point

• /opt/: extra applications provided by third parties

• /root/: administrator's (root's) personal files

• /run/: volatile runtime data that does not persist across
  reboots (not yet included in the FHS)

• /sbin/: system programs

• /srv/: data used by servers hosted on this system

• /tmp/: temporary files (this directory is often emptied at
  boot)

• /usr/: applications (this directory is further subdivided
  into bin, sbin, lib according to the same
  logic as in the root directory) Furthermore, /usr/share/
  contains architecture-independent data. The /usr/local/
  directory is meant to be used by the administrator for installing
  applications manually without overwriting files handled by the
  packaging system (dpkg).

• /var/: variable data handled by services. This includes log
  files, queues, spools, and caches.

• /proc/ and /sys/ are specific to the Linux kernel
  (and not part of the FHS). They are used by the kernel for exporting
  data to user space.

An in-depth exploration of each of these directories' functions is
beyond the scope of this Module. For now, it is important only to
understand what kind of files they house at a high level. One of the
most important directories from a user's perspective (and therefore
from a security perspective) is the /home directory, so let's
turn our attention there.

The contents of a user's home directory are not standardized,
but there are still a few noteworthy conventions. As mentioned
previously, we can refer to the user's home directory with the tilde
(~) symbol. That is useful to know because command interpreters
automatically replace a tilde with the correct directory (which is
stored in the HOME environment variable, and whose usual value is
/home/user/).

Traditionally, application configuration files are stored directly
under one's home directory, but the filenames usually start with a
dot, which makes them hidden (as discussed previously). In addition,
some programs use multiple configuration files organized in one
directory (for instance, ~/.ssh/).

Graphical desktops usually have shortcuts to display the contents of
the ~/Desktop/ directory. Finally, the email system sometimes
stores incoming emails into a ~/Mail/ directory.

The Linux Environment

This Learning Unit covers the following Learning Objectives:

1. Identify the default shell in use
2. Set variables in the terminal
3. Display variable values
4. Understand environment variables
5. Set aliases
6. Identify the Linux version and distribution
7. Identify the Linux kernel

This Learning Unit will take approximately 90 minutes to complete.

For the sake of this Learning Unit we will use the Zsh shell. We
highly encourage you to experiment with different shells as you
continue your study.

To know which shell environment we are operating under, we can use the
echo command with the text "$SHELL" as input.

kali@kali:~$ echo $SHELL
/usr/bin/zsh
Copy

Listing 17 - Using the echo command to output the contents
of the $SHELL variable.

The output in Listing 17 shows that we are operating
under the Zsh environment. Notice the dollar ($) sign preceding the
word "SHELL" in the input. This indicates that "SHELL" is the name of
a variable. By invoking the variable's name, we can get its value.

In general, a variable is a name:value pair. We can create a new
shell variable called offsec, which stores the value "123"
by using the offsec=123 command. Once we hit I, the
variable is going to be stored. We can then reference it using the
echo $offsec command.

kali@kali:~$ offsec=123

kali@kali:~$ echo $offsec
123

kali@kali:~$ echo offsec
offsec
Copy

Listing 18 - Setting a shell variable

Note that when we echo the word "offsec" without the dollar
sign, Zsh just interprets it as a regular string. Our offsec
variable is now set and stored, but only exists for the current shell
environment. In other words, if we were to close our terminal and then
open a new one, $offsec would no longer hold the value "123".

kali@kali:~$ echo $offsec

kali@kali:~$ 
Copy

Listing 19 - Demonstrating shell variables' locality

Some variables, like $SHELL, are environment variables.
Environment variables exist beyond the shell in which they
are created. In other words, the value of $SHELL is
globally recognized across the machine. $SHELL does not
necessarily reflect the currently running shell environment. Instead,
$SHELL is just the name of the user's preferred shell, and
it is typically identified in the /etc/passwd file. There are
many other default environment variables, which can be explored using
the set command.

kali@kali:~$ set
'!'=0
'#'=0
'$'=1235
'*'=(  )
...
MODULE_PATH=/usr/lib/x86_64-linux-gnu/zsh/5.8
NULLCMD=cat
OLDPWD=/home/kali
OPTARG=''
OPTIND=1
OSTYPE=linux-gnu
PATH=/usr/local/sbin:/usr/sbin:/sbin:/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games
...
SHELL=/usr/bin/zsh
...
Copy

Listing 20 - The output of set command.

The output includes the $SHELL variable.

Another useful feature offered in modern shell environments is the
ability to consult the history of commands typed by users. In this
case, Zsh stores history information in the file indicated by the
$HISTFILE variable.

kali@kali:~$ echo $HISTFILE
/home/kali/.zsh_history
Copy

Listing 21 - The HISTFILE variable value.

Since the Linux system can manage multiple users, each user has their
own .zsh_history file and restricted permissions are set on
it such that no other user can read other users' histories without
explicit permission.

kali@kali:~$ whoami
kali

kali@kali:~$ pwd
/home/kali

kali@kali:~$ cat /home/user2/.zsh_history
cat: /home/user2/.zsh_history: Permission denied
Copy

Listing 22 - Trying to read another user's .zsh_history file.

We can explore the history^[30] of commands
run by the current user by with the history command, or by
printing out the ~/.zsh_history file itself.

kali@kali:~$ history
example_command1
example_command2
example_command3
...

kali@kali:~$ cat ~/.zsh_history
example_command1
example_command2
example_command3
...
Copy

Listing 23 - Reading current user history.

Several other features allow that allow a user to use shells like Zsh
to optimize user workflows. Aliases^[31] for example, can be used
as shortcuts to other commands. If we want to run the ls -la
command many times, we can create a shortcut for it as ll.

kali@kali:~$ alias ll='ls -la'

kali@kali:~$ ll
total 40
drwxrwxrwt  10 root   wheel   320 Apr 24 13:19 .
drwxr-xr-x   6 root   wheel   192 Mar 18 20:10 ..
-rw-r--r--@  1 kali   wheel     0 Apr 21 19:56 MozillaUpdateLock-2656FF1E876E9973
-rw-r--r--   1 kali   wheel    10 Apr 21 15:18 a
...
Copy

Listing 24 - Setting an alias

Aliases can be either temporary or permanent. Temporary aliases are
not persistent between shells, so if we were to set an alias in one
shell, and then open a new shell environment, the new environment will
not contain the alias. Permanent aliases are persistent across shells,
even after the system reboots.

In Listing 24, we set up a temporary alias. If instead we
want to create a persistent one, then we can do so by modifying the
~/.zshrc file to include the line alias ll='ls -la'.

Once that is done, we would run source ~/.zshrc to reset the
shell environment and to accommodate the new alias. We should then be
able to run ll directly.

In a penetration testing scenario, once we obtain access to a
target, one of the first things we might want to do is called system
enumeration. This is a fancy term for information gathering about
the system to better understand the machine we've attacked, often to
elevate our permissions.

We can get the version of the distribution by reading the
/etc/issue file.

kali@kali:~$ cat /etc/issue
Kali GNU/Linux Rolling \n \l
Copy

Listing 25 - Finding the distribution version

To get more than just the distribution version of the system, we can
use the uname command. Invoking uname without any options
is equivalent to using the -s option, which prints out the
kernel name.

kali@kali:~$ uname
Linux
Copy

Listing 26 - Printing the machine's kernel name

To get information about the kernel version, we can add the
-v option.

kali@kali:~$ uname -v
#1 SMP Debian 5.9.1-1kali2 (2020-10-29)
Copy

Listing 27 - Printing the machine's kernel version

If we wanted to get the kernel release we can use the -r
option.

kali@kali:~$ uname -r
5.9.0-kali1-amd64
Copy

Listing 28 - Printing the machine's kernel release

Finally, we can print all the information accessible by uname
with the -a option.

kali@kali:~$ uname -a
Linux academy 5.9.0-kali1-amd64 #1 SMP Debian 5.9.1-1kali2 (2020-10-29) x86_64 GNU/Linux
Copy

Listing 29 - Printing all the information accessible by uname

There are many other programs, commands, and files from which we can
determine much more information, and we'll cover many of them as we
continue along this Module and learning path.

Linux File Management

This Learning Unit covers the following Learning Objectives:

1. Create, delete, copy, and move files and directories
2. Manage files with wildcards
3. Find files in Kali Linux

This Learning Unit will take approximately 90 minutes to complete.

We can create an empty file with the touch command by
providing the file name as an argument. If the file already exists,
the touch command will only modify the accessed timestamp of the file,
but will leave the contents alone.

kali@kali:~$ touch newfile

kali@kali:~$ ls -l
total 0
-rw-r--r-- 1 kali kali 0 Jun 11 09:27 newfile
Copy

Listing 30 - Creating an empty file with touch

In Listing 30, we created an empty file called
newfile, and then list it out in the directory with the
ls -l command. If we wanted to delete or remove the file,
we could use the rm command.

kali@kali:~$ rm newfile 

kali@kali:~$ ls

kali@kali:~$ 
Copy

Listing 31 - Removing a file with rm

It's important to note that once a file is deleted, it is deleted.
We won't have an opportunity to undo this if we made a mistake.
Deleting a Linux file via the command-line removes it permanently,
unlike a GUI based "recycle bin" on Windows or "Trash" on a mac.
Always make sure to double check syntax before using rm.

To make a directory, we can use the mkdir command followed by
the desired name of the directory. Directory names can contain spaces
but since we will be spending a lot of time at the command-line, we
can save ourselves a lot of trouble by using hyphens or underscores
instead. These characters will also make auto-completes (executed with
the A key) much easier to use.

kali@kali:~$ mkdir newdir

kali@kali:~$ ls -l
total 4
drwxr-xr-x 2 kali kali 4096 Jun 11 09:31 newdir
-rw-r--r-- 1 kali kali    0 Jun 11 09:27 newfile
Copy

Listing 32 - Creating an empty directory with mkdir

We can delete a directory with the rmdir command, as long as
it's empty.

kali@kali:~$ rmdir newdir

kali@kali:~$ ls -l
total 0
-rw-r--r-- 1 kali kali 0 Jun 17 09:27 newfile
Copy

Listing 33 - Deleting an empty directory with rmdir

To move a file to a different directory, we can use the mv
command.

kali@kali:~$ mv newfile newdir2

kali@kali:~$ ls -lR
.:
total 4
drwxr-xr-x 2 kali kali 4096 Jun 17 09:37 newdir2

./newdir2:
total 0
-rw-r--r-- 1 kali kali 0 Jun 17 09:27 newfile
Copy

Listing 34 - Deleting an empty directory with rmdir

In Listing 35, we move the newfile file to the
newdir2 directory. We then use ls -lR to list the
contents of both of our home directory, as well as newdir2.

We can also use mv to rename a file, by moving it within
the current working directory. For example, if we wanted to rename
offsec.txt to offsec123.txt then we can do so as
follows.

kali@kali:~$ touch offsec.txt

kali@kali:~$ ls
offsec.txt

kali@kali:~$ mv offsec.txt offsec123.txt

kali@kali:~$ ls
offsec123.txt
Copy

Listing 36 - Renaming a file with mv

The same applies for directories, meaning that if we want to rename
a directory named offsecdir to offsecdir123 then we
can use the following.

kali@kali:~$ mkdir offsecdir

kali@kali:~$ ls
offsecdir

kali@kali:~$ mv offsecdir offsecdir123

kali@kali:~$ ls
offsecdir123
Copy

Listing 37 - Renaming a directory with mv

Sometimes we might want to rename or move a file, but also preserve
the original. We can do this with the cp command, which
can be used to copy files within the same directory or into other
directories.

kali@kali:~$ cat hi.txt
hello

kali@kali:~$ cp hi.txt bye.txt

kali@kali:~$ cat bye.txt
hello

kali@kali:~$ ls
bye.txt  hi.txt
Copy

Listing 38 - Copying a file with cp

In Listing 38 we use cat to view the contents
of the hi.txt file. We then use cp to copy the
contents into a new file called bye.txt. Finally, ls
demonstrates that both files are present in the current directory.

Now that we now how to create, delete, move, rename, and copy basic
files, let's learn about a special kind of file called a symbolic
link, or symlink. A symbolic link is just a shortcut that points to
the original file or directory.

There are two kinds of symlinks: soft links, and hard links. Soft
links allow us to "mirror" the contents of the original file into
a new one. This means that if we were to modify the original file,
then the symlink file would be modified as well.

Let’s experiment with this. First, let's create a file using
touch, and then use echo to write text to the file.
We will talk more about what the greater-than (>) symbol does in a
later section. Finally, we use cat to check the content of
the file.

kali@kali:~$ touch original.txt

kali@kali:~$ echo 'hello world' > original.txt

kali@kali:~$ cat original.txt
hello world
Copy

Listing 39 - Creating a file with content in it.

Now that the file is created, let’s move to the /tmp/
directory using with cd. We'll then use ln
with the -s option to create a soft symlink pointing at
original.txt. Last, we use the ls -la command to
observe the new symlink.

kali@kali:~$ cd /tmp

kali@kali:/tmp$ ln -s ~/original.txt symlink.txt

kali@kali:/tmp$ ls -la
lrwxrwxrwx  1 kali  kali    21 Jun  3 17:43 symlink.txt -> /home/kali/original.txt
Copy

Listing 40 - Creating a soft symbolic link.

Let’s confirm the contents of the symlink include "hello world". Then,
we'll change the contents of original.txt by overwriting
it with new input, using echo. Finally, we'll print out the
contents of the symlink with cat, and observe the results.

kali@kali:/tmp$ cat symlink.txt
hello world

kali@kali:/tmp$ echo 'goodbye planet' > ~/original.txt

kali@kali:/tmp$ cat symlink.txt
goodbye planet
Copy

Listing 41 - Viewing and modifying the content of the symbolic link.

Later, we'll learn about the concept of file permissions. Note
that if we set different file permissions on either the original file
or the symlink, the mirrored file's permissions will not change.
We leave it as a research exercise to find out why (hint: inode).

Hard links are copies of the original file, but more accurately, they
are exact mirrors of the original file. Let's experiment.

First, let’s create a file named offsec123.txt in the current
user’s home directory using touch. Then we'll write some text
inside the file using echo again.

kali@kali:~$ touch offsec123.txt

kali@kali:~$ echo 'This is a test.' > offsec123.txt
Copy

Listing 42 - Creating a file with content in it.

Now with the file created, let's move to the /tmp/ directory
using cd, and then create a hard link with ln.
Notice we are not using any options. We then will run cat to
check that both files contain the same content.

kali@kali:~$ cd /tmp

kali@kali:/tmp$ ln ~/offsec123.txt hardlink.txt

kali@kali:/tmp$ ls -la
-rw-r--r--  2 kali  kali     5 Jun  3 17:49 hardlink.txt
Copy

Listing 43 - Creating a hard symbolic link.

Next, we will use rm to delete the original file.

kali@kali:~$ rm offsec123.txt

kali@kali:~$ cd /tmp

kali@kali:/tmp$ cat hardlink.txt
This is a test.
Copy

Listing 44 - Deleting the hard symbolic link.

It's interesting to note that when we view /tmp/'s directory
listing, the hardlink.txt still exists. Furthermore, when we
output the file using cat, we will still read the original
contents.

Wildcard^[32] characters allow us to reference a large
set of files at once, and help manage files on the command-line (among
other tasks). The most common wildcard character is the asterisk
(*), which represents zero or more characters. Let's explore
some use-cases to better understand the concept.

The following command will display all files in the current directory
that begin with the letter "a".

kali@kali:~$ ls -l a*
-rw-r--r--  1 root  wheel    515 Jun  6  2020 afpovertcp.cfg
lrwxr-xr-x  1 root  wheel     15 Mar  9 20:49 aliases -> postfix/aliases
-rw-r-----  1 root  wheel  16384 Jun  6  2020 aliases.db
-rw-r--r--  1 root  wheel   1051 Jun  6  2020 asl.conf
-rw-r--r--  1 root  wheel    149 Oct 30 08:55 auto_home
-rw-r--r--  1 root  wheel    195 Oct 30 08:55 auto_master
-rw-r--r--  1 root  wheel   1935 Oct 30 08:55 autofs.conf
...
Copy

Listing 45 - Listing specific files using *.

Essentially, the string "a*" tells the command-line to include
every file that meets the condition "a, then any zero or more
characters".

The wildcard operator can be used with other programs like mv, cp,
and rm.

In this section, we'll explore how to find files within a Linux
system. The three most common commands used to locate files in
Kali Linux are find,^[33] locate,^[34] and
which.^[35] These utilities are similar, but they work
and return data in different ways, so they are useful in different
circumstances.

The which command searches through the directories that are defined in
the $PATH environment variable for a given file name.

If a match is found, which returns the full path to the file.

kali@kali:~$ echo $PATH
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

kali@kali:~$ which sbd
/usr/bin/sbd
Copy

Listing 46 - Exploring the which command

The locate command is the quickest way to find the location of files
or directories in Kali. To provide a much shorter search time, locate
searches a built-in database named locate.db rather than
the entire hard disk itself. This database is automatically updated
regularly by an automated task.

Let's use locate to find the path to the whoami.exe
binary on kali.

kali@kali:~$ locate whoami.exe
/usr/share/windows-resources/binaries/whoami.exe
Copy

Listing 47 - Exploring the locate command

The find program enables us to walk a file hierarchy recursively in
order to search for files and directories. It takes many arguments and
the usage can be very complex. Some of its key options are:

• -name - Search by filename or directory name (case
  sensitive).

• -iname - Search by filename or directory name (case
  insensitive).

• -type f/d/l/s - Search by type which can be (files,
  directories, links or sockets)

• -size - Search by file or directory size.

• -mtime - Search using the last modified date criteria.

• -o - Allows us to combine multiple values of the same argument.

• -user - Find files and directories based on their owner.

Let's review a few examples of use cases for find.

To search for a file named offsec.txt in the root
directory recursively, we would use: find / -name offsec.txt -type
f

To search for a JPG file in the current directory
recursively, we would use: find . -name "*.jpg"

To search for all .txt files owned by the kali user
that are more than 1MB in size: find / -user kali -size 1M -type f
-name "*.txt"

Piping and Redirection

This Learning Unit covers the following Learning Objectives:

1. Understand piping and redirection
2. Understand standard input, output, and errors
3. Redirect output to a file
4. Append output to the end of a file
5. Redirect standard errors
6. Pipe a command into another

This Learning Unit will take approximately 90 minutes to complete.

In this section we will be focusing on piping and
redirection^[36] in a Linux shell. These features
will allow us to combine more commands to achieve more
flexible and versatile outcomes.

It is important to understand that every program that runs on the
command-line in Linux-based systems automatically has three data
streams^[37] connected to it. Each data stream is also
assigned a file descriptor integer value:

• STDIN (0): This is the standard input on which data is fed
  into the program. Essentially, this is the part of the terminal
  accepting the text we type in.

• STDOUT (1): The standard output on the other hand is just how
  data is printed by the program, which defaults to the terminal.

• STDERR (2): Lastly, standard error is for error messages,
  which also gets printed to the terminal by default.

Piping and redirection are means by which we may connect these
streams between different programs and files to direct data in ways
we want them to flow. For example, we might want to use the STDOUT of
program1 as the STDIN of program2.

There are different symbols for piping and data redirection and we
will introduce them one by one.

We already saw the > operator earlier when we wanted to
write text to a file with echo. > allows us to
redirect and save the output of one program on the STDOUT stream to a
file instead of the default behavior of printing it to the screen.

kali@kali:~$ echo hello           
hello

kali@kali:~$ echo hello > file.txt

kali@kali:~$ cat file.txt
hello
Copy

Listing 48 - Simple example of redirecting to a new file

When we run the command echo hello, we print "hello" to
standard output (i.e. the terminal). But when we use echo hello >
file.txt, "hello" gets printed to file.txt instead.

Let's say we want to save the listing of files from the ls
program to a file called listing.txt. We can do so with the
following command.

kali@kali:~$ ls -lah > listing.txt

kali@kali:~$ cat listing.txt
total 1056
drwxr-xr-x  85 root  wheel   2.7K Apr 19 17:41 .
drwxr-xr-x   6 root  wheel   192B Mar 18 20:10 ..
-rw-r--r--   1 root  wheel   515B Jun  6  2020 afpovertcp.cfg
lrwxr-xr-x   1 root  wheel    15B Mar  9 20:49 aliases -> postfix/aliases
-rw-r-----   1 root  wheel    16K Jun  6  2020 aliases.db
...
Copy

Listing 49 - Redirecting to a new file.

In Listing 49, we observe that the output of ls
-lah gets written to the file listing.txt, instead of
directly to the terminal.

If we redirect the output to a non-existent file, the file will
be created automatically. Notice however, that if the file already
exists, our redirect will replace the file's content. We'll need to be
careful with redirection since there is no undo function.

To append additional data to an existing file (as opposed to
overwriting the file), we will use the >> operator.

kali@kali:~$ cat redirection_test.txt
Kali Linux is an open source project

kali@kali:~$ echo "that is maintained and funded by OffSec" >> redirection_test.txt

kali@kali:~$ cat redirection_test.txt
Kali Linux is an open source project
that is maintained and funded by OffSec
Copy

Listing 50 - Redirecting the output to an existing file

In Listing 50, the new text is appended to a new line
inside the referenced file.

Where > lets us write the output of a program as the input to a
file, the < operator allows us to read a file and use its output
as the input to a program.

kali@kali:~$ wc -m < test.txt
89
Copy

Listing 51 - Redirecting from a file.

In Listing 51, we feed the contents of
text.txt to the program wc, which when invoked with
the -m option counts the number of characters in a file.

We can also redirect error messages. Let's try running ls on
a file that does not exist and observe what happens.

kali@kali:~$ ls -lah filethatdoesnotexist.txt
ls: filethatdoesnotexist.txt: No such file or directory
Copy

Listing 52 - STDERR

In Listing 52, we try to run ls on
filethatdoesnotexist.txt and receive an error message. Even
though both standard output and standard error appear on the terminal,
they are actually separate data streams. This means we cannot use >
to redirect the output of Listing 52 to a file. (Try
it out. What happens?)

To redirect errors instead of a program's output to a file, we use the
2> operator.

kali@kali:~$ ls -lah filethatdoesnotexist.txt 2> errors.txt

kali@kali:~$ cat errors.txt
ls: filethatdoesnotexist.txt: No such file or directory
Copy

Listing 53 - Redirecting STDERR

The file descriptor for STDERR is 2. Therefore, the 2>
operator will allow us to redirect the error output of a program as
the input to a file, just as > lets us use the normal output
of a program as the input to a file. In fact, > can be
considered a convenient short form of 1>.

So far, we've been redirecting data from programs to files or vice
versa, using > and < respectively. We can also
use the output from one program as the input to a second program via
piping with the | symbol.

Let’s say we want to find out how many files are in our current
working directory. To do this, we can use a combination of ls
and wc.

kali@kali:~$ ls -l
total 32
drwxr-xr-x 2 kali kali 4096 Jun 23 15:09 Desktop
drwxr-xr-x 2 kali kali 4096 Jun 23 15:09 Documents
drwxr-xr-x 2 kali kali 4096 Jun 23 15:09 Downloads
drwxr-xr-x 2 kali kali 4096 Jun 23 15:09 Music
drwxr-xr-x 2 kali kali 4096 Jun 23 15:09 Pictures
drwxr-xr-x 2 kali kali 4096 Jun 23 15:09 Public
drwxr-xr-x 2 kali kali 4096 Jun 23 15:09 Templates
drwxr-xr-x 2 kali kali 4096 Jun 23 15:09 Videos

kali@kali:~$ ls -l | wc -l 
9
Copy

Listing 54 - Redirecting STDERR using a Combination of ls and wc

We used the output of ls -l as the input to wc -l.
We will need to subtract 1 from the result to get the true number of
files, since the first line of output does not represent a file.

Note that the total number at the top of the results for ls -l
is the total number of file system blocks, including indirect blocks,
used by the listed files and not the total number of files listed.

Another use case might be to sort the output of ls
alphabetically, which we can do with sort.^[38]

kali@kali:~$ ls | sort
afpovertcp.cfg
aliases
aliases.db
apache2
asl
asl.conf
...
Copy

Listing 55 - Piping STDOUT to STDIN

Combined with other programs and options, piping can get very complex,
but this is also what makes it extremely powerful.

Searching and Text Manipulation

This Learning Unit covers the following Learning Objectives:

1. Understand how to search for strings in a file
2. Replace text in a file through the command-line
3. Filter output
4. Compare files
5. Edit files

This Learning Unit will take approximately 60 minutes to complete.

We can improve our ability to search for and manipulate files
and text by learning a few more commands. In this section, we'll
focus on grep^[39], sed^[40],
cut^[41] and awk^[42]. Each one of
these tools is extremely powerful and can be quite complex, so we will
only scratch the surface here.

To take advantage of these tools, it's helpful to know a bit about
how regular expressions (regex) work. A regular expression is
a special text string for describing a search pattern. There are a
number of excellent resources online that go into further detail on
regular expressions.^[43]^,^[44]^,^[45]^,^[46]

grep searches text files for a given regular expression and outputs
any line containing a match to the standard output, which is usually
the terminal screen.

Some of the most commonly used options with grep include
-r for recursive searching in a directory, and -i to
ignore text case.

Let's quickly do an example. First, we'll list all of the files and
directories in the /usr/bin directory with ls. We'll
use the -la option to put each entry on its own line and to
include hidden files. Then we'll pipe the output into grep
and search files or directories for the string "zip" as part of the
file name.

kali@kali:~$ ls -la /usr/bin | grep zip
-rwxr-xr-x  3 root root   34480 Jan 29  2017 bunzip2
-rwxr-xr-x  3 root root   34480 Jan 29  2017 bzip2
-rwxr-xr-x  1 root root   13864 Jan 29  2017 bzip2recover
-rwxr-xr-x  2 root root    2301 Mar 14  2016 gunzip
-rwxr-xr-x  1 root root  105172 Mar 14  2016 gzip
Copy

Listing 56 - Searching for any file(s) in /usr/bin containing
"zip"

In Listing 56, we listed all the files in the
/usr/bin directory with ls and piped the output
into grep, which searches for any line containing the string
"zip". Understanding the grep tool and when to use it can prove
incredibly useful.

sed is a powerful stream editor. At a very high level,
sed performs text editing on a stream of text, which will
either be a set of specific files or standard output.

kali@kali:~$ echo "I need to try hard" | sed 's/hard/harder/'
I need to try harder
Copy

Listing 57 - Replacing a word in the output stream

In Listing 57, we created a stream of text using the
echo command and then piped it to sed to replace the
word "hard" with "harder". Note that by default the output has been
automatically redirected to standard output.

The cut command is simple, but often comes in quite handy.
It is used to extract a section of text from a line and write it to
standard output.

The most commonly-used option are -f, for the field number
we are cutting, and -d for the field delimiter.

To observe it in action, let's echo a line of text and pipe
it to cut. We'll extract the second field using a comma
(,) as the field delimiter.

kali@kali:~$ echo "I hack binaries,web apps,mobile apps and just about anything else" | cut -f 2 -d ","
web apps
Copy

Listing 58 - Extracting a field using cut

cut can be also used on lines in text files. For example, we can
extract a list of users from /etc/passwd by using :
as a delimiter and retrieving the first field.

kali@kali:~$ cut -d ":" -f 1 /etc/passwd
root
daemon
bin
sys
sync
games
...
Copy

Listing 59 - Extracting usernames using cut

awk is a programming language designed for text processing
and is typically used as a data extraction and reporting tool.
It happens to be extremely powerful, and has significantly more
functionalities than we can demonstrate here. Two commonly used features
are the -F option, which is the field separator, and the
print subcommand, which outputs the resulting text.

kali@kali:~$ echo "hello::there::friend" | awk -F "::" '{print $1, $3}'
hello friend
Copy

Listing 60 - Extracting fields from a stream using a
multi-character separator in awk

Here we echoed a line and piped it to awk to extract the first and
third fields using "::" as a field separator.

The most prominent difference between the cut and the
awk examples we showed is that cut can only use a
single character as a field delimiter, while awk, as shown
in Listing 60, is much more flexible. As a general rule,
when we start building a command involving multiple string-processing
operations, we may want to consider switching to awk instead.

In this section we will explore how the Linux system allows us to
compare files. File comparison may not seem very important at first
glance, but system administrators, network engineers, penetration
testers, IT support technicians, and many other technically-oriented
professionals rely on this skill pretty often.

The comm^[47] command compares two text files, displaying
the lines that are unique to each one, as well as the lines they have
in common. It outputs three columns: the first contains lines that
are unique to the first file or argument; the second contains lines
that are unique to the second file or argument; and the third column
contains lines that are shared by both files. The -n option,
where "n" is either 1, 2, or 3, can be used to suppress one or more
columns, depending on the need.

kali@kali:~$ cat scan-a.txt
192.168.1.1
192.168.1.2
192.168.1.3
192.168.1.4
192.168.1.5

kali@kali:~$ cat scan-b.txt
192.168.1.1
192.168.1.3
192.168.1.4
192.168.1.5
192.168.1.6

kali@kali:~$ comm scan-a.txt scan-b.txt
								192.168.1.1
192.168.1.2
								192.168.1.3
								192.168.1.4
								192.168.1.5
			  192.168.1.6

kali@kali:~$ comm -12 scan-a.txt scan-b.txt
192.168.1.1
192.168.1.3
192.168.1.4
192.168.1.5
Copy

Listing 61 - Using comm to compare files

In Listing 61, the first command displayed the unique
lines in scan-a.txt, the unique lines in scan-b.txt
and the lines found in both files respectively. The second command
displayed only the lines that were found in both files since we
suppressed the first and second columns with -12.

The diff^[48] command is used to detect differences between
files, similar to comm. However, diff is much more complex
and supports many output formats. Two of the most popular formats
include the context format (-c) and the unified format
(-u). The following example demonstrates the difference
between the two formats.

kali@kali:~$ diff -c scan-a.txt scan-b.txt
*** scan-a.txt	2018-02-07 14:46:21.557861848 -0700
--- scan-b.txt	2018-02-07 14:46:44.275002421 -0700
***************
*** 1,5 ****
  192.168.1.1
- 192.168.1.2
  192.168.1.3
  192.168.1.4
  192.168.1.5
--- 1,5 ----
  192.168.1.1
  192.168.1.3
  192.168.1.4
  192.168.1.5
+ 192.168.1.6

kali@kali:~$ diff -u scan-a.txt scan-b.txt
--- scan-a.txt	2018-02-07 14:46:21.557861848 -0700
+++ scan-b.txt	2018-02-07 14:46:44.275002421 -0700
@@ -1,5 +1,5 @@
 192.168.1.1
-192.168.1.2
 192.168.1.3
 192.168.1.4
 192.168.1.5
+192.168.1.6
Copy

Listing 62 - Using diff to compare files

The output uses the - indicator to show that the line appears
in the first file, but not in the second. Conversely, the +
indicator shows that the line appears in the second file, but not in
the first.

The most notable difference between the two formats is that the
unified format does not show lines that match between files, making
the resulting output shorter. The indicators have identical meanings
in both formats.

File editing in a command shell environment is an extremely important
Linux skill, especially during a penetration test if you happen to get
access to a Unix-like OS.

Although there are text editors like gedit^[49] and
Leafpad^[50] that might be more visually appealing due to
their graphical user interface, we will focus on text-based terminal
editors, which emphasize both speed and versatility.

There are plenty of tools for editing text but for the sake of
this Module, we will be focusing on one of the simplest options,
nano.^[51]

It is important to note that nano is not installed by default on some
distributions. On Kali you can install nano using sudo apt install
nano if it is not already installed.

We can open an existing file by supplying the filename as an argument
to nano on the command-line.

We can also create a new file that doesn’t exist by invoking
nano with no arguments.

Once the editor is opened we can edit the content as we would normally
do in a graphical text editor. Navigating through the text can be done
using the arrow keys and deletion can be done with the backspace.

Saving the file can be done using C+o, and exiting
the editor with C+x. Note that if the file content
is modified and C+x is hit, the editor will prompt
us if we would like to save the modifications or not. We can then
reply with "Y" or "N".

To search for a string in the text, press C+w, type
in the search term then press Enter. The cursor will move to the first
match. To move to the next match, press E+w.

For additional information regarding nano, refer to its online
documentation.^[52]

Linux Basics II

In this Module, we will cover the following learning units:

• Users and Groups
• File Permissions
• Linux Processes
• File and Command Monitoring
• Linux Applications
• Scheduled Tasks
• Logs
• Disk Management
• Linux Basics I & II - Cumulative Exercise

Users and Groups

This Learning Unit covers the following Learning Objectives:

1. Understand critical files for Linux users and groups
2. Understand user and group IDs
3. Change user attributes
4. Change user context

Most security professionals will need to understand details about how
user accounts and group memberships are stored on a Unix-like system.
As an example, it is important to be able to list the user accounts
and check whether an account is disabled or can be used to log in
with.

There are few different authentication schemes that can be used on
Linux systems. The most commonly used authentication scheme makes use
of the /etc/passwd and /etc/shadow files.

Information about user accounts are stored in the /etc/passwd
file.^[53] This file can be read by anyone because some
utilities depend on it, for example to map user IDs to usernames.
For this reason, the fingerprints of the passwords are stored in
a different file, called /etc/shadow.^[54] The
shadow file can only be accessed with high privileges.

A colon separates the different properties of /etc/shadow.
An example of the content of /etc/shadow is shown in Listing

root:$6$pfiZTzNB1wav3OFG$GDwbvI44D7sBuX7Q.6LmNWx.RaU6nzxZWCCkkMNIXCkvANnNoYogV983NSLkG1cfpaW4mmyFuTOKkDf53hVkh/:18781:0:99999:7:::
Copy

Listing 1 - Example entry of /etc/shadow file.

Let's review the individual elements that appear in this entry.

Each part of this entry is separated by a colon. The root
entry is the username in plain text. The next piece, which is quite
long, represents an encrypted password. We'll learn more about
encryption in a later Module. For now, it's enough to know that the
password has been manipulated in such a way that someone browsing this
file cannot easily read what the password is.

The next piece, 18781, is the last time the password was
changed, in timestamp^[55] format. 0 is The minimum
number of days required between password changes, and 99999
is the maximum number of days the password is valid for. The last
number, 7, indicates the number of days in advance of the
password's expiration date that the user will be warned that they will
need to change their password.

The following is an example entry of the /etc/passwd file.

john:x:1002:1002:John Doe,,,:/home/john:/bin/bash
Copy

Listing 2 - Example entry of /etc/passwd file.

Again, a colon separates the different properties. Let's review
each of them in the order they appear.

john is the username in plain text. x indicates
that the password needs to be pulled from the shadow file.
As we mentioned previously, this is because the passwd file
is world readable, meaning that any user can read its content. The
shadow file can only be accessed with high privileges.

Continuing, the first 1002 indicates the User ID^[56]
(UID), which is a unique number on the system for each account, and
the second 1002 is the primary Group ID (GID) the user
belongs to respectively. Additional group memberships are defined in
the /etc/group file. We'll discuss the concept of groups in
detail later.

Let's continue. John Doe is in an optional field called the
comment field. It is most commonly used for informational
purposes. Usually, it contains the user's full name. Next,
/home/john is the user's home directory location, and
/bin/bash is the default shell environment for the user.

It is important to note that the UID of 0 has a special role. It
is always assigned to the system administrator superuser, called
root. It is technically possible to manually set UID 0 for
other users and thereby grant them elevated privileges, but it is not
recommended.

User accounts can be disabled and enabled in several ways.

As system administrators, one method we can use to control
user accounts is to lock a user's password. The usermod -L
username and passwd -l username commands both place an
exclamation mark (!) at the beginning of the password hash in
/etc/shadow. This change can be manually applied to the file
as well. The result is that any password authentication attempt will
fail for the given user.

Another method is to mark the user account as expired. When an
account expiration date is set, it is stored in the 8th field within
/etc/shadow. We can use the chage command by
providing the -E switch to set an expiration date for a user
account. The easiest way to expire an account is to provide a date in
the past.

A third method is to change the default shell in /etc/passwd
either to /bin/false, which will exit immediately, or to
/sbin/nologin, which is a simple program that displays a
message saying that the account is currently not available. We can use
the usermod command with the -s option to change the
default shell of a user.

If we would like to know whether a user account is disabled or locked,
we have to verify all three methods mentioned above. We can use the
following commands to check for expiration dates, password-locks, and
non-interactive shells.

root@kali:~# passwd --status jane
jane L 03/15/2021 0 99999 7 -1

root@kali:~# chage -l jane
Last password change                                    : Mar 15, 2021
Password expires                                        : never
Password inactive                                       : never
Account expires                                         : never
Minimum number of days between password change          : 0
Maximum number of days between password change          : 99999
Number of days of warning before password expires       : 7
Copy

Listing 3 - An example of how to verify account lock and password expiration dates

In Listing 3, we used passwd --status to
confirm that jane's password is locked. We then use chage -l
to confirm that the account is not expired.

root@kali:~# grep ^jane /etc/passwd
jane:x:5001:5001::/home/jane:/sbin/nologin
Copy

Listing 4 - An example of how to verify a user's shell

In Listing 4, we use grep with
a regular expression to find a line that begins with "jane". Grep
returned jane's properties in /etc/passwd, where we can
verify that the default shell is /sbin/nologin. This means that login
access for the account is disabled.

Groups allows system administrators to configure more flexible and
granular permissions, as we'll discover later on. Information about
user groups are stored in the /etc/group file.^[57]
Let's review an example entry of this file.

bluetooth:x:117:kali
Copy

Listing 5 - Example entry of /etc/group file

The file structure follows a similar convention to
/etc/passwd. Let's quickly review the individual parts.
bluetooth is the group name, x is the group password
(usually not used), and 117 is the group ID. kali
is a particular user that belongs to the specified group. Note
that only users who have a secondary group membership are listed in
/etc/group, since primary group memberships are stored in
/etc/passwd.

In this section, we will get familiar with how to execute privileged
commands and how to switch contexts across different users. As
a security professional, it is important to know how to identify
misconfigurations, or to notice automation implemented in a way that
can be abused.

The sudo^[58]^,^[59]^,^[60]^,^[61] command can be used to
execute a command with elevated privileges. To be able to use sudo,
our low-privileged user account has to be a member of the sudo group
(on Debian based Linux distributions, like Kali). The word "sudo"
stands for "Superuser-Do", and we can think of it as changing the
effective user of the command that follows.

As an example of this, let's run the whoami command, which
lists the current effective user.

kali@kali:~$ whoami
kali

kali@kali:~$ sudo whoami
[sudo] password for kali:
root
Copy

Listing 6 - practicing with sudo.

To run this command, we need to provide the password of the current
user, which will be cached for five minutes by default. In other
words, once we successfully authenticate our low-level user with
sudo, we will keep the elevated permissions for the cached
amount of time. If we were to run sudo whoami again, we would
not receive the password prompt.

Also note that the cursor does not move and there is no other output
(for example, a series of asterisks) to indicate that the password is
being typed.

Custom configurations can be applied in the /etc/sudoers
file.^[62]

root@kali:~# cat /etc/sudoers
#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults        env_reset
Defaults        mail_badpass
Defaults        secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root    ALL=(ALL:ALL) ALL

# Allow members of group sudo to execute any command
%sudo   ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "@include" directives:

@includedir /etc/sudoers.d
Copy

Listing 7 - /etc/sudoers entry.

The output indicates that the root user has all sudo permissions. We
can specify that a user does not have to provide the password to run
sudo, and we can limit the list of executable commands allowed through
sudo. We can use the -l or --list option to list
the allowed commands for the current user.

kali@kali:~$ sudo -l
[sudo] password for kali: 
Matching Defaults entries for box on academy:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User kali may run the following commands on kali:
    (ALL : ALL) ALL
Copy

Listing 8 - sudo -l output.

One of the most commonly used sudo arguments is the
-i option, which allows the current user to run a login shell
as the root user (a command may also be specified):

kali@kali:~$ id
uid=1000(kali) gid=1000(kali) groups=1000(kali)

kali@kali:~$ sudo id
uid=0(root) gid=0(root) groups=0(root)

kali@kali:~$ id
uid=1000(kali) gid=1000(kali) groups=1000(kali)

kali@kali:~$ sudo -i

root@kali:~# id
uid=0(root) gid=0(root) groups=0(root)
Copy

Listing 9 - sudo -i usage.

Here, we execute the id command four times to check our
UID. The first time, we note that our kali user's UID is 1000, which
is often the default UID of the first human user on a Linux system.
We then use sudo id to execute a single command as root.
Since we are executing the command as root, id outputs root's UID.
However, this UID does not belong to kali, and so when we execute
id as kali the third time, we get kali's UID of 1000 once
again.

Finally, we execute sudo -i to give the kali user root's
login shell. Now when we run id for the fourth time, we
are provided with root's UID. Notice also that the user's prompt has
changed from a "$" character to a "#". This convention identifies an
elevated user on many Linux shells, including Bash and Zsh.

The su^[63] command can be used to switch users. Without any
parameters, the default behavior is to run an interactive shell as the
root user.

Invoking su will prompt us for root's password, whereas sudo requires
only that we know our own user's password. Note that on some Linux
distributions, password authentication for the root user is disabled
by default. Kali is an example of such a distribution.

We can either make changes to the configuration files or we can use
root privileges with the sudo command. Let's practice that
now and switch to the root user.

kali@kali:~$ whoami
kali

kali@kali:~$ sudo su

root@kali:/home/kali# whoami
root
Copy

Listing 10 - Simple su usage.

We began this example as the kali user. This is confirmed when we run
the whoami command. When we run sudo su, we are given the
root login shell. When we run whoami a second time, it shows
the current user is root.

We can also use su to execute a single command as the target
user by using the -l and -c options as follows.

root@kali:~# whoami
root

root@kali:~# su -l offsec -c "whoami"
offsec
Copy

Listing 11 - Running the whoami command as another user using su.

File Permissions

This Learning Unit covers the following Learning Objectives:

1. Understand Linux DAC permissions
2. Change Linux file permissions
3. Understand setuid, sgid, and the sticky bit

As a security professional, it is essential to be familiar with file
permissions^[64]^,^[65] on
Linux distributions. For example, sometimes a low privileged users can
modify configuration files that enable privilege escalation.

One of the defining features of Linux and other UNIX derivatives
is that most resources, including files, directories, devices, and
network communications are represented in the filesystem. Put
colloquially, "everything is a file".

Each file or directory has specific permissions for three categories
of users.

• Its owner (symbolized by u, as in user)

• Its owner group (symbolized by g, as in group), representing all
  the members of the group

• The others (symbolized by o, as in other)

In addition to this, three types of rights can be combined.

• reading (symbolized by r, as in read)

• writing (or modifying, symbolized by w, as in write)

• executing (symbolized by x, as in eXecute)

In the case of a file, these rights are easily understood: read access
allows a user to read the content (including copying), write access
allows changing it, and execute access allows running it (which will
only work if it is a program).

A directory is handled differently from a file. Read access gives the
right to consult the list of its contents (files and directories).
Write access allows creating or deleting files. Finally, execute
access allows crossing through the directory to access its contents
(for example, with the cd command). Being able to cross
through a directory without being able to read it gives the user
permission to access known entries, but only by knowing their exact
name.

We can use the long option (-l) of ls to view the
permissions of files and directories.

kali@kali:~$ ls -l /etc/passwd
-rw-r--r-- 1 root root 3348 Mar 19 07:14 /etc/passwd
Copy

Listing 12 - Example permissions on a file

In Listing 12, we note that the root user has
read and write privileges on /etc/passwd/, while the root
group and everyone else have only read permission.

We can use the chown command to change the ownership
properties of a file. There are two ways of representing rights.
Among them, the symbolic representation is probably the easiest to
understand and remember.

The symbolic representation involves the letter symbols mentioned
above. We can define rights for each category of users (u/g/o),
by setting them explicitly (with =), by adding (with
+), or subtracting (with -).

For example, we can use the u=rwx,g+rw,o-r formula to give
the owner read, write, and execute rights, add read and write rights
for the owner group, and remove read rights for other users.

Rights not altered by the addition or subtraction in such a command
remain unmodified. The letter a, for all, covers all three
categories of users so that a=rx grants all three categories
the same rights (read and execute, but not write).

kali@kali:~$ ls -la perms
-rw-r--r-- 1 kali kali 0 Mar 22 10:40 perms

kali@kali:~$ chown root perms
chown: changing ownership of 'perms': Operation not permitted

kali@kali:~$ sudo chown root perms
[sudo] password for kali:

kali@kali:~$ ls -l perms
-rw-r--r-- 1 root kali 0 Mar 22 10:40 perms
Copy

Listing 13 - Example of changing ownership on a file

In Listing 13, the owner of the
perms file has been changed from kali to root. After this,
even though the user executing the command is the owner of the file,
the execution fails. Note that the chown command has to be
executed with elevated privileges to change a file's owner to another
user.

The chmod command can be used to change the permission
settings on a file or a directory.

kali@kali:~$ ls -l perms
-rw-r--r-- 1 kali kali 0 Mar 22 10:40 perms

kali@kali:~$ chmod u+x,g+w,o-r perms

kali@kali:~$ ls -l perms
-rwxrw---- 1 kali kali 0 Mar 22 10:40 perms
Copy

Listing 14 - Example of changing permissions on a file

In Listing 14, we granted (+) execute
permissions (x) to the owner user (u), granted (+) write (w)
permissions to the owner group (g), and revoked (-) read (r)
permissions to other users on the perms file.

The second way to represent rights is via an octal numeric
representation. It associates each right with a value.

• 4 for read

• 2 for write

• 1 for execute

We associate each combination of rights with the sum of the three
figures.

• 7 = 4 + 2 + 1 = read, write, and execute

• 6 = 4 + 2 = read and write

• 5 = 4 + 1 = read and execute

• 3 = 2 + 1 = write and execute

Finally, 0 represents no permissions. Notice how there is only one
way to obtain each of the combination numbers by adding together the
individual components.

To set rights for each of the three different categories, we assign
one of these numeric values to them in the usual order (owner, then
group, then others).

For instance, the chmod 754 command will set the
following rights:

• read, write, and execute for the owner (since 7 = 4 + 2 + 1)
• read and execute for the group (since 5 = 4 + 1)
• read-only for others

chmod 600 <file> allows for

• read and write permissions for the owner
• no rights for anyone else.

The most frequent right combinations are 755 for executable files and
directories, and 644 for data files.

Note that the use of octal notation only allows us to set all the
rights at once on a file; we cannot use it to add a new right, such as
read access for the group owner since we must take into account the
existing rights and compute the new corresponding numerical value.

Aside from the rwx permissions described above, two additional special
rights pertain to executable files: setuid and setgid. These are
symbolized with the letter "s".

If these two rights are set, either an uppercase or lowercase "s" will
appear in the permissions. This allows the current user to execute the
file with the rights of the owner (setuid) or the owner's group
(setgid).

It's important to note a few things here. The first is that many files
will have root as the owner of the file. If the setuid attribute is
assigned to an executable, that program will run under the super-user
identity. This means that any user who manages to subvert a setuid
root program to call a command of their choice can effectively
impersonate the root user and have all rights on the system.
Penetration testers regularly search for these types of files when
they gain access to a system as a way of escalating their privileges.

Let's review an example. We'll list the attributes of the passwd
command, which is used to change passwords for user accounts.

kali@kali:~$ ls -la /usr/bin/passwd
-rwsr-xr-x 1 root root 63960 Feb  7  2020 /usr/bin/passwd
Copy

Listing 15 - Setuid example

The lowercase "s", which appears here, means both execute and setuid
flags are set. A capital "S" would mean the setuid bit is set, but
that the execute flag is missing.

Let's do a quick experiment with changing the setuid bit. We'll make
a copy of the id command, which displays the current user and group
membership. If we run this command as the kali user, it will output
"kali", but if we change its ownership to root and set the setuid
flag, it will output "root" even though we run it as the kali user.

kali@kali:~$ which id
/usr/bin/id

kali@kali:~$ sudo cp /usr/bin/id /usr/bin/idcopy

kali@kali:~$ ls -la /usr/bin/idcopy
-rwxr-xr-x 1 root root 48064 Jun 30 14:53 /usr/bin/idcopy

kali@kali:~$ idcopy                              
uid=1000(kali) gid=1000(kali) groups=1000(kali)

kali@kali:~$ sudo chown root:kali /usr/bin/idcopy
[sudo] password for kali:

kali@kali:~$ sudo chmod u+s /usr/bin/idcopy      

kali@kali:~$ ls -la /usr/bin/idcopy 
-rwsr-xr-x 1 root kali 48064 Jun 30 14:53 /usr/bin/idcopy*

kali@kali:~$ idcopy
uid=1000(kali) gid=1000(kali) euid=0(root) groups=1000(kali)
Copy

Listing 16 - Setting setuid example

Let's take a moment to understand this example.

First, we made a copy of the id executable named idcopy, and
put it in the /usr/bin directory. This allows us to invoke
idcopy directly from the command line, since /usr/bin
is inside our $PATH. We reviewed the permissions, which showed two
things. We note that the "s" is missing. In addition, the owner of
this file is kali.

Perhaps predictably, when we ran idcopy, the output showed
that the user executing the command has UID 1000, which belongs to
kali.

For our experiment to work, we will need to change the owner to root
and then change the permissions so that this command runs with the
permissions of the owner of the executable rather than the current
user. We used sudo chown root:kali /usr/bin/idcopy to change
the owner of this file to root.

The critical step here was setting the setuid bit with sudo chmod
u+s /usr/bin/idcopy. When we reviewed the permissions again, we
note that the "s" is present and that the owner of this file is now
root.

Finally, we ran /usr/bin/idcopy and noted that while the
UID of the executing user remains 1000 (belonging to kali), the
effective UID, or EUID, is now 0 (belonging to root). This means
that the program ran as if root was the executor, even though it was
invoked by kali.

Like the setuid bit, the setgid bit is a special file permission that
enables users to inherit the effective group ID of the file group
owner. This special bit is set similarly to the setuid bit.

From the kali terminal, we can run id -g to learn the
effective group id of the current user. To learn more about
the setgid bit, we'll experiment with this command by making a second
copy of id, similar to what we did above.

Running idcopy also gives us the numeric identifier for the
current group, which is GID 1000, belonging to the kali group. We'll
use sudo chown kali:root to change the group owner for this
file.

Finally, we'll change this command to execute with the group owner
permissions with the following: chmod g+s filename When we
run idcopy2 again, it outputs "egid=0", indicating that the
command was executed in the context of the root user group. The output
provides further evidence of this, since it shows that the executor is
part of the root group as well.

kali@kali:~$ sudo cp /usr/bin/id /usr/bin/idcopy2

kali@kali:~$ cp /usr/bin/id /usr/bin/idcopy2

kali@kali:~$ ls -la /usr/bin/idcopy2
-rwxr-xr-x 1 kali kali 48064 Jun 30 14:53 idcopy2

kali@kali:~$ idcopy2
uid=1000(kali) gid=1000(kali) groups=1000(kali)

kali@kali:~$ sudo chown kali:root /usr/bin/idcopy2

kali@kali:~$ sudo chmod g+s /usr/bin/idcopy2

kali@kali:~$ ls -la /usr/bin/idcopy2
-rwxr-sr-x 1 kali root 48064 Jun 30 14:53 /usr/bin/idcopy2

kali@kali:~$ idcopy2
uid=1000(kali) gid=1000(kali) egid=0(root) groups=0(root),1000(kali)
Copy

Listing 17 - Setting setgid example

The setgid bit also applies to directories. Any newly-created item
in a directory is automatically assigned the owner group of the
parent directory. It does this instead of, for example, inheriting
the creator's main group.

Because of this, we don't have to change our main group (with the
newgrp command) when working in a file tree shared between several
users of the same dedicated group.

The sticky bit (symbolized by the letter "t") is a permission that
is only useful in directories. It is commonly used for temporary
directories where everybody has write access (such as /tmp/).
It restricts deletion of files so that only their owner or the owner
of the parent directory can delete them. Without this, everyone could
delete each other's files in /tmp/.

kali@kali:~$ ls -ld /tmp
drwxrwxrwt 18 root root 4096 Mar 19 11:39 /tmp
Copy

Listing 18 - Sticky bit example

In this example, the letter "t" appears at the end of the permission
settings, indicating that the sticky bit is set.

Linux Processes

This Learning Unit covers the following Learning Objectives:

1. Understand process IDs
2. Understand foreground and background processes
3. Send a process to the background
4. Execute a background process in the foreground
5. List running processes
6. Kill a Linux process

The Linux kernel manages multitasking through the use of processes.
In this section we'll cover how to interact with them.

In the context of this Module, a process is an instance of a running
program. Every time we run a program via our terminal, we begin a new
process. The Linux kernel maintains information about each process to
help keep them organized, and each process is assigned a number called
a process ID^[66] (PID).

Linux also contains the concept of jobs to ease the user's workflow
during a terminal session. As an example, cat error.txt | wc
-m is a pipeline of two processes, which the shell considers
a single job. Job control^[67]^,^[68]
refers to the ability to selectively suspend the execution of jobs and
resume their execution at a later time.

When jobs are running in the foreground, the terminal is occupied
and no other commands can be executed until the current one finishes.
Up until this point, all or most of the commands we have run have
finished within a very short period, almost instantly. However, in
some cases, the execution can take much longer. We can send those
jobs to the background to regain control of the terminal and execute
additional commands.

The quickest way to background a process is to append an ampersand
(&) to the end of the command to send it to the background
immediately after it starts. Let's try a brief example.

kali@kali:~$ ping -c 400 localhost > ping_results.txt &
Copy

Listing 19 - Backgrounding a job right after
it starts

In Listing 19, we sent 400 ICMP echo requests
to the local interface with the ping command and wrote the
results to a file called pingresults.txt. We'll learn more
about ICMP and _ping in the networking Module. For now, notice that
the inclusion of the "&" symbol causes execution to automatically run
in the background, leaving the shell free for additional operations.

If we had not supplied the "&" symbol, the command would have
run in the foreground, and we would be forced to either cancel the
command with C+c, wait until the command finishes
to regain control of the terminal, or suspend the job using
C+z after it has already started.

Suspending a job pauses it until it is told to resume. Once a job
has been suspended, we can resume it in the background by using the
bg command:

kali@kali:~$ ping -c 400 localhost > ping_results.txt
^Z
[1]+  Stopped                 ping -c 400 localhost > ping_results.txt

kali@kali:~$ bg
[1]+ ping -c 400 localhost > ping_results.txt

kali@kali:~$
Copy

Listing 20 - Using bg to background a job

Here, we started the job and then suspended it. The "^Z" character
represents the keystroke combination C+z.This
allows us to continue using the terminal as we wish. Next, we used
bg to resume the job.

Suspending jobs can be very useful, but we need to keep in mind that
some processes are time sensitive and may give incorrect results if
left suspended for too long. For instance, in the ping example, the
echo reply may come back but if the process is suspended when the
packet comes in, the process may miss it, leading to incorrect output.
Always consider the context of what the commands you are running are
doing when engaging in job control.

To quickly check on the status of our ICMP echo requests, we need to
make use of two additional commands: jobs and fg.

The built-in jobs utility lists the jobs that are running in
the current terminal session, and fg returns a job to the
foreground. These commands are shown in action below:

kali@kali:~$ ping -c 400 localhost > ping_results.txt
^Z
[1]+  Stopped                 ping -c 400 localhost > ping_results.txt

kali@kali:~$ find / -name sbd.exe
^Z
[2]+  Stopped                 find / -name sbd.exe

kali@kali:~$ jobs
[1]-  Stopped                 ping -c 400 localhost > ping_results.txt
[2]+  Stopped                 find / -name sbd.exe

kali@kali:~$ fg %1
ping -c 400 localhost > ping_results.txt
^C

kali@kali:~$ jobs
[2]+  Stopped                 find / -name sbd.exe

kali@kali:~$ fg
find / -name sbd.exe
/usr/share/windows-resources/sbd/sbd.exe
Copy

Listing 21 - Using jobs to look at jobs and fg to
bring one into the foreground

Here we started one job and suspended it, and then we started another
job and suspended that as well. When we ran the jobs command,
the output showed our two commands. We moved the first one to the
foreground with fg %1, where %1 indicates the ping
job. We can use a shortcut to terminate a long-running process and
regain control of the terminal. That was the case here, where we ended
the ping job with C+c. The "^C" character
shows this action.

From there, we can run jobs again, but this time it only shows
the find command we suspended. We can restart this job by running
fg.

There are various ways to refer to a job in the shell. The "%"
character followed by a JobID represents a job specification. The
JobID can be a PID number or we can use one of the following symbol
combinations:

• %Number : Refers to a job number such as %1 or %2.

• %String : Refers to the beginning of the suspended command's name
  such as %commandNameHere or %ping.

• %+ OR %% : Refers to the current job.

• %- : Refers to the previous job.

Note that if only one process has been backgrounded, the job number is
not needed.

One of the most useful commands to monitor processes on mostly any
Unix-like operating system is ps^[69] (short for process
status). Unlike the jobs command, ps lists processes system-wide,
not only for the current terminal session. This utility is considered
a standard on Unix-like OSes and its name is so well-recognized that
even on Windows PowerShell, ps is a predefined command alias for the
Get-Process cmdlet, which essentially serves the same purpose.

As a penetration tester, one of the first things to check after
obtaining remote access to a system is to understand what software is
currently running on the compromised machine. This could help us
elevate our privileges or collect additional information to
acquire further access into the network.

As an example, let's start the Mousepad text editor and then try to
find its PID from the command line by using the ps command.

kali@kali:~$ ps -ef
UID         PID   PPID  C STIME TTY          TIME CMD
root          1      0  0 10:18 ?        00:00:02 /sbin/init
root          2      0  0 10:18 ?        00:00:00 [kthreadd]
root          3      2  0 10:18 ?        00:00:00 [rcu_gp]
root          4      2  0 10:18 ?        00:00:00 [rcu_par_gp]
root          5      2  0 10:18 ?        00:00:00 [kworker/0:0-events]
root          6      2  0 10:18 ?        00:00:00 [kworker/0:0H-kblockd]
root          7      2  0 10:18 ?        00:00:00 [kworker/u256:0-events_unbound
root          8      2  0 10:18 ?        00:00:00 [mm_percpu_wq]
root          9      2  0 10:18 ?        00:00:00 [ksoftirqd/0]
root         10      2  0 10:18 ?        00:00:00 [rcu_sched]
...
Copy

Listing 22 Common ps syntax to list all the processes
currently running

We used two options here. The first (e) selects all
processes. The second (f) displays the full format listing (UID, PID,
PPID, etc.)

Finding our Mousepad application in that massive listing is definitely
not easy, but since we know the application name we are looking for,
we can replace the -e switch with -C (select by
command name).

kali@kali:~$ ps -fC mousepad
UID         PID   PPID  C STIME TTY          TIME CMD
kali       1307    938  0 10:57 ?        00:00:00 mousepad
Copy

Listing 23 - Narrowing down our search by specifying the
process name

In Listing 23, the process search has returned a single
result from which we gathered Mousepad's PID. It's worth spending some
time exploring the man page for the ps command (man ps).
If we master it, ps can become a very effective tool for process
management.

Let's say we now want to stop the Mousepad process without interacting
with the GUI. The kill command can help us here, as its purpose is
to send a specific signal^[70] to a process. To
use kill, we need the PID of the process we want to send the
signal to. From the previous listing, we know the PID is 1307.

kali@kali:~$ kill 1307

kali@kali:~$ ps aux | grep mousepad
kali       1313  0.0  0.0   6144   888 pts/0    S+   10:59   0:00 grep mousepad
Copy

Listing 24 - Stopping mousepad by sending the
SIGTERM signal

Because the default signal for kill is SIGTERM (request termination), our
application has been terminated. This has been verified in the example by
using ps after killing Mousepad.

File and Command Monitoring

This Learning Unit covers the following Learning Objectives:

1. Understand the value of monitoring files and commands
2. Monitor log files changes with tail
3. Monitor command activities with watch

It is extremely valuable to know how to monitor files and commands in
real-time during a penetration test. Two commands that help with such
tasks are tail^[71] and watch.^[72]

The most common use of tail is to monitor log file entries
as they are being written. For example, we may want to monitor the
Apache logs to determine if a web server is being contacted by a given
client that we are attempting to attack via a client-side exploit.
Let's examine this practical example to understand how we might use
tail.

kali@kali:~$ sudo tail -f /var/log/apache2/access.log 
127.0.0.1 - - [02/Feb/2021:12:18:14 -0500] "GET / HTTP/1.1" 200 3380 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0"
127.0.0.1 - - [02/Feb/2021:12:18:14 -0500] "GET /icons/openlogo-75.png HTTP/1.1" 200 6040 "http://127.0.0.1/" "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0"
127.0.0.1 - - [02/Feb/2021:12:18:15 -0500] "GET /favicon.ico HTTP/1.1" 404 500 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0"
Copy

Listing 25 - Monitoring the Apache log file using tail command.

The -f option (follow) is very useful as it continuously
updates the output as the target file grows. Another convenient switch
is -n X, which outputs the last "X" number of lines, instead
of the default value of 10.

The watch command is used to run a designated command at
regular intervals. By default, it runs every two seconds, but we can
specify a different interval by using the -n X option to
have it run every "X" number of seconds. For example, this command
will list logged-in users (via the w command) once every 5
seconds.

kali@kali:~$ watch -n 5 w

............

Every 5.0s: w                                     kali: Tue Jan 23 21:06:03 2021

 21:06:03 up 7 days,  3:54,  1 user,  load average: 0.18, 0.09, 0.03
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
kali     tty2     :0               16Jan18  7days 16:29   2.51s /usr/bin/python
Copy

Listing 26 - Monitoring logged in users using the
watch command.

To terminate the watch command and return to the interactive terminal
we can use C+c.

Linux Applications

This Learning Unit covers the following Learning Objectives:

1. Understand the Advanced Package Tool manager
2. Search APT repositories for packages
3. Update package repositories on a Linux system
4. Install a Linux application with apt
5. Remove a Linux application with apt
6. Install a Linux application with dpkg

In this Learning Unit, we will be exploring the Advanced Package
Tool (APT) toolset as well as other commands that can be used to
search for, install, or remove applications.

APT is a set of tools that helps manage packages, or applications,
on Ubuntu, Debian, and related Linux distributions. Since
Kali^[73] is based on Debian,^[74] we can use
APT to install and remove applications, update packages, and even
upgrade the entire system.

There are many advantages to using APT. Put simply, many
applications rely on multiple libraries to function. These
libraries, which are pre-compiled functions, routines, classes,
and so on, can be quite large and are often shared between multiple
applications. For example, if we have version 1.7 of a certain library
installed, but our application requires version 2.0 of that same
library, our application won't function. These relationships can
become increasingly complex and result in what is colloquially known
as dependency hell.^[75] The greatest benefit of APT is that
it can recursively satisfy requirements and dependencies, keeping us
out of trouble.

Like any other official program or tool in Linux-based systems, APT
has a manual that we can explore by entering man apt on the
command line.

kali@kali:~$ man apt
APT(8)      
NAME
       apt - command-line interface

SYNOPSIS
       apt [-h] [-o=config_string] [-c=config_file] [-t=target_release] [-a=architecture] {list | search | show | update |
           install pkg [{=pkg_version_number | /target_release}]...  | remove pkg...  | upgrade | full-upgrade | edit-sources |
           {-v | --version} | {-h | --help}}

DESCRIPTION
       apt provides a high-level commandline interface for the package management system. It is intended as an end user interface and enables
       some options better suited for interactive usage by default compared to more specialized APT tools like apt-get(8) and apt-cache(8).

       Much like apt itself, its manpage is intended as an end user interface and as such only mentions the most used commands and options
       partly to not duplicate information in multiple places and partly to avoid overwhelming readers with a cornucopia of options and
       details.

       update (apt-get(8))
           update is used to download package information from all configured sources. Other commands operate on this data to e.g. perform
           package upgrades or search in and display details about all packages available for installation.

       upgrade (apt-get(8))
           upgrade is used to install available upgrades of all packages currently installed on the system from the sources configured via
           sources.list(5). New packages will be installed if required to satisfy dependencies, but existing packages will never be removed. If
           an upgrade for a package requires the removal of an installed package the upgrade for this package isn't performed.
Manual page apt(8) line 1 (press h for help or q to quit)
...
Copy

Listing 27 - Reading the apt manual

The apt tool has a number of options, arguments, and
functions, but we'll continue by experimenting a bit with the most
common ones.

Information regarding APT packages is cached locally to speed up any
sort of operation that involves querying the APT database. Therefore,
it is always good practice to update the list of available packages,
including information related to their versions, descriptions, etc. We
can do this with the apt update command. We will need to run
this with sudo so that we have the proper permissions.

kali@kali:~$ sudo apt update
[sudo] password for kali: 
Hit:1 http://kali.mirror.globo.tech/kali kali-rolling InRelease Reading package lists... Done
Building dependency tree
Reading state information... Done
699 packages can be upgraded. Run 'apt list --upgradable' to see them.
Copy

Listing 28 - Using apt update

After the APT database has been updated, we can upgrade the installed
packages and core system to the latest versions using the apt
upgrade command. Again, we have to use sudo for this
operation.

To upgrade a single package, we add the package name
after the apt upgrade command such as apt upgrade
metasploit-framework.

The apt-cache search command displays much of the information
stored in the internal cached package database. For example, let’s
say we would like to install the pure-ftpd application via
APT. The first thing we have to do is to find out whether or not the
application is present in the Kali Linux repositories. To do so, we
pass the search term on the command line.

kali@kali:~$ apt-cache search pure-ftpd
mysqmail-pure-ftpd-logger - real-time logging system in MySQL - Pure-FTPd traffic-logg pure-ftpd - Secure and efficient FTP server
pure-ftpd-common - Pure-FTPd FTP server (Common Files)
pure-ftpd-ldap - Secure and efficient FTP server with LDAP user authentication pure-ftpd-mysql - Secure and efficient FTP server with MySQL user authentication pure-ftpd-postgresql - Secure and efficient FTP server with PostgreSQL user authentica resource-agents - Cluster Resource Agents
Copy

Listing 29 - Using apt-cache search

The output indicates that the application is present in the
repository. There are also a few authentication extensions for the
pure-ftpd application that may be installed if needed.

Interestingly, the resource-agents package is showing up in our
search even though its name does not contain the "pure-ftpd" keyword.
This is because apt-cache looks for the requested keyword in the
package's description rather than the package name itself.

To confirm that the resource-agents package description does
contains the "pure-ftpd" keyword, we can pass the package name to
apt show as follows.

kali@kali:~$ apt show resource-agents Package: resource-agents
Version: 1:4.2.0-2
...
Description: Cluster Resource Agents
This package contains cluster resource agents (RAs) compliant with the Open Cluster Framework (OCF) specification, used to interface with various services in a High Availability environment managed by the Pacemaker resource manager.
.
Agents included:
AoEtarget: Manages ATA-over-Ethernet (AoE) target exports AudibleAlarm: Emits audible beeps at a configurable interval ...
NodeUtilization: Node Utilization
Pure-FTPd: Manages a Pure-FTPd FTP server instance
Raid1: Manages Linux software RAID (MD) devices on shared storage
Copy

Listing 30 - Using apt show

The output of Listing 30 clarifies why the resource-agents
application was mysteriously showing up in Listing 29.

The apt install command can be used to add a package to
the system by providing the package name. Let’s continue with the
installation of pure-ftpd.

kali@kali:~$ sudo apt install pure-ftpd
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following additional packages will be installed: pure-ftpd-common
The following NEW packages will be installed: pure-ftpd pure-ftpd-common
0 upgraded, 2 newly installed, 0 to remove and 0 not upgraded. Need to get 309 kB of archives.
After this operation, 880 kB of additional disk space will be used. Do you want to continue? [Y/n] y
Get:1 http://kali.mirror.globo.tech/kali kali-rolling/main amd64 pure-ftpd-common all Get:2 http://kali.mirror.globo.tech/kali kali-rolling/main amd64 pure-ftpd amd64 1.0.4 Fetched 309 kB in 4s (86.4 kB/s)
Preconfiguring packages ...
Copy

Listing 31 - Using apt install

Note the confirmation request that happens during this operation.

We can also remove a package with the command apt remove
--purge, which completely removes packages from a Linux-based
system. It is important to note that removing a package with apt
remove removes all package data, but leaves usually small
(modified) user configuration files behind, in case the removal
was accidental. Adding the --purge option removes all
leftovers.

kali@kali:~$ sudo apt remove --purge pure-ftpd 
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following package was automatically installed and is no longer required: pure-ftpd-common
Use 'sudo apt autoremove' to remove it. The following packages will be REMOVED:
pure-ftpd*
0 upgraded, 0 newly installed, 1 to remove and 0 not upgraded.
After this operation, 581 kB disk space will be freed.
Do you want to continue? [Y/n] y
(Reading database ... 388024 files and directories currently installed.)
Removing pure-ftpd (1.0.47-3) ...
Cannot find cached rlinetd's config files for service ftp, ignoring remove request Processing triggers for man-db (2.8.5-2) ...
(Reading database ... 388011 files and directories currently installed.)
Purging configuration files for pure-ftpd (1.0.47-3) ...
Processing triggers for systemd (240-6) ...
Copy

Listing 32 - Using apt remove

Again there is an additional prompt to confirm that we want to remove
pure-ftpd, and then we can to completely delete the
program from our Kali machine.

The apt autoremove command helps with removing package
dependencies that are not needed anymore. This can happen as a result
of installing a package and then removing it, where its dependencies
remain on the system.

dpkg is the core tool used to install a package, either directly
or indirectly through APT. It is also the preferred tool to use when
operating offline, since it does not require an Internet connection.
Note that dpkg will not install any dependencies that the package
might require.

To install a package with dpkg, we need to provide the
-i or --install option and the path to the
.deb package file. This assumes that the .deb file
of the package to install has been previously downloaded or obtained
in some other way.

kali@kali:~$ sudo dpkg -i man-db_2.7.0.2-5_amd64.deb
(Reading database ... 86425 files and directories currently installed.)
Preparing to unpack man-db_2.7.0.2-5_amd64.deb ...
Unpacking man-db (2.7.0.2-5) over (2.7.0.2-4) ...
Setting up man-db (2.7.0.2-5) ...
Updating database of manual pages ...
Processing triggers for mime-support (3.58) ...
...
Copy

Listing 33 - Using dpkg -i to install the man-db
application

Scheduled Tasks

This Learning Unit covers the following Learning Objectives:

1. Understand cron
2. List and find scheduled jobs
3. Schedule future tasks

The Linux-based job scheduler is known as Cron. Cron makes it
possible to schedule the execution of tasks. These tasks are usually
commands and scripts associated with system maintenance.

Scheduled tasks are listed under the /etc/cron.*
directories, where "*" represents the frequency the task will run
on. For example, tasks that will be run daily can be found under the
/etc/cron.daily directory. Each script is listed in its own
subdirectory.

kali@kali:~$ ls -lah /etc/cron*
-rw-r--r-- 1 root root 1.1K Feb 10  2020 /etc/crontab

/etc/cron.d:
total 36K
drwxr-xr-x   2 root root 4.0K Feb 17 12:56 .
drwxr-xr-x 161 root root  12K Jun 21 16:37 ..
-rw-r--r--   1 root root  201 Mar 20  2020 e2scrub_all
-rw-r--r--   1 root root  607 Sep 13  2019 john
-rw-r--r--   1 root root  712 May 11  2020 php
-rw-r--r--   1 root root  102 Feb 10  2020 .placeholder
-rw-r--r--   1 root root  396 Jul 14  2020 sysstat

/etc/cron.daily:
total 64K
drwxr-xr-x   2 root root 4.0K Mar  2 10:56 .
drwxr-xr-x 161 root root  12K Jun 21 16:37 ..
-rwxr-xr-x   1 root root  539 Apr  2  2019 apache2
-rwxr-xr-x   1 root root 1.5K Jul  8  2020 apt-compat
-rwxr-xr-x   1 root root  255 Jun 22  2020 calendar
-rwxr-xr-x   1 root root  157 Dec 13  2017 debtags
-rwxr-xr-x   1 root root 1.3K Jan 26 10:08 dpkg
-rwxr-xr-x   1 root root  377 Apr  8  2020 logrotate
-rwxr-xr-x   1 root root 1.1K Jul  5  2020 man-db
-rwxr-xr-x   1 root root  628 Dec  2  2020 mlocate
-rwxr-xr-x   1 root root 1.4K Mar 10  2020 ntp
-rw-r--r--   1 root root  102 Feb 10  2020 .placeholder
-rwxr-xr-x   1 root root  383 Jul  4  2020 samba
-rwxr-xr-x   1 root root  518 Aug 27  2020 sysstat

/etc/cron.hourly:
total 20K
drwxr-xr-x   2 root root 4.0K Sep  1  2020 .
drwxr-xr-x 161 root root  12K Jun 21 16:37 ..
-rw-r--r--   1 root root  102 Feb 10  2020 .placeholder

/etc/cron.monthly:
total 24K
drwxr-xr-x   2 root root 4.0K Sep  1  2020 .
drwxr-xr-x 161 root root  12K Jun 21 16:37 ..
-rw-r--r--   1 root root  102 Feb 10  2020 .placeholder
-rwxr-xr-x   1 root root  144 Jun  5  2013 rwhod

/etc/cron.weekly:
total 24K
drwxr-xr-x   2 root root 4.0K Mar  2 10:56 .
drwxr-xr-x 161 root root  12K Jun 21 16:37 ..
-rwxr-xr-x   1 root root  813 Jul  5  2020 man-db
-rw-r--r--   1 root root  102 Feb 10  2020 .placeholder
kali@kali:~$ 
Copy

Listing 34 - Listing all cron jobs on Linux

Reading from the bottom, we note that man-db runs weekly and rwhod
runs monthly. There are no programs that run hourly, but there are
quite a few tasks scheduled to run daily.

It is worth noting that system administrators often add their own
scheduled tasks in the /etc/crontab file. These tasks should
be inspected carefully^[76] for insecure file permissions
as most jobs in this particular file will run as root.

kali@kali:~$ cat /etc/crontab
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

# Example of job definition:
# .---------------- minute (0 - 59)
# |  .------------- hour (0 - 23)
# |  |  .---------- day of month (1 - 31)
# |  |  |  .------- month (1 - 12) OR jan,feb,mar,apr ...
# |  |  |  |  .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
# |  |  |  |  |
# *  *  *  *  * user-name command to be executed
17 *    * * *   root    cd / && run-parts --report /etc/cron.hourly
25 6    * * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6    * * 7   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6    1 * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
5 0 * * * root /var/scripts/user_backups.sh
#
kali@kali:~$ 
Copy

Listing 35 - Reading /etc/crontab

Listing 35 reveals a backup script running as root.
If this file has weak permissions, we may be able to leverage this to
escalate our privileges.

Logs

This Learning Unit covers the following Learning Objectives:

1. Understand Linux log files
2. Recall where to find log files on a Linux system
3. Read logs with journalctl

As an information security professional, it is important to be
familiar with where and how logs are stored. In response to a security
breach, we can use logs to reconstruct events and understand what
happened and when.

Perhaps as an indication of how important these log files are, many
of them cannot be read without root permissions. As a result, when
interacting with these files, we will often need to use sudo.

Most Unix-like systems, as well as services running on them, produce
logs within the /var/log directory.

kali@kali:~$ ls -l /var/log
total 2544
-rw-r--r--  1 root  root     2911 Jul  7 08:33 alternatives.log
drwxr-x---  2 root  adm      4096 Jun 23 15:04 apache2
drwxr-xr-x  2 root  root     4096 Jul  7 08:31 apt
-rw-r-----  1 root  adm      5444 Jul  7 13:39 auth.log
-rw-------  1 root  root        0 Jun 25 14:39 boot.log
-rw-rw----  1 root  utmp        0 Jul  7 08:25 btmp
-rw-r-----  1 root  adm     41195 Jul  7 13:39 daemon.log
-rw-r-----  1 root  adm      1157 Jul  7 08:40 debug
-rw-r--r--  1 root  root   156531 Jul  7 08:34 dpkg.log
-rw-r--r--  1 root  root    32032 Jun 23 15:07 faillog
-rw-r--r--  1 root  root     5692 Jun 23 15:05 fontconfig.log
...
Copy

Listing 36 - Reviewing our list of log files

Many of these logs are plain text files and can be read with any
application able to display the contents of a file. We'll use the
tail command to show the three most recent additions to
auth.log, a log file that stores all authentication attempts.
Since the file is in /var/log/, we'll need to add the
absolute path.

kali@kali:~$ sudo tail -3 /var/log/auth.log
Jul  7 14:01:38 kali sudo: pam_unix(sudo:session): session closed for user root
Jul  7 14:01:48 kali sudo:    kali : TTY=pts/0 ; PWD=/home/kali ; USER=root ; COMMAND=/usr/bin/tail -3 /var/log/auth.log
Jul  7 14:01:48 kali sudo: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=1000)
Copy

Listing 37 - Reading the last few lines of auth.log

Since we ran this command with sudo, we can observe the
authentication that occurred when we ran the command in the log
itself.

There are also log files that store information in a special
structure. One example of a log file with a special structure is
/var/log/wtmp,^[77] which keeps a record about all login,
logout, and runlevel^[78] change events. This file can be
processed by the last^[79] and who^[80] commands,
for example.

Since the wtmp log file can become quite long, we'll pipe the
output to tail -5 and only read the last five entries.

kali@kali:~$ who /var/log/wtmp | tail -5 
robert   tty7         2021-07-03 09:46 (:0)
nichole  tty7         2021-07-03 11:53 (:0)
kali     tty7         2021-07-06 08:04 (:0)
robert   tty7         2021-07-06 15:09 (:0)
kali     tty7         2021-07-07 14:03 (:0)
Copy

Listing 38 - checking who has logged in to this machine

This log shows several users, including our kali user, logging in to
the computer for several days.

In addition to the logs we've reviewed already, we can also find logs
for other types of events. For example, the kernel emits messages
that it stores in a ring buffer whenever something interesting
happens (such as a new USB device being inserted, a failing hard disk
operation, or initial hardware detection on boot). We can retrieve the
kernel logs with the dmesg command.

Finally, systemd also stores multiple logs (stdout/stderr output
of services, syslog messages, kernel logs) and makes it easy to query
them with journalctl.

Without any arguments, journalctl will dump all the available
logs chronologically. With the -r option, it will reverse
the order so that newer messages are shown first. With the -f
option, journalctl will continuously print new log entries as
they are appended to its database. Finally, the -u option can
limit the messages to those emitted by a specific systemd unit. For
example, we could dump available logs pertaining to ssh.service with
journalctl -u ssh.service.

Logs are also an excellent troubleshooting tool. When some command
or action fails, logs can help us understand why the unexpected
phenomenon is happening.

During the following exercises we are going to get familiar with the
above mentioned tools. Some exercises might depends on an additional
options. The available options and their descriptions can be displayed
by providing the --help option to the command.

Disk Management

This Learning Unit covers the following Learning Objectives:

1. Identify free memory space
2. Identify hard drive memory utilization
3. Read partition tables with fdisk
4. Mount external drives

The most prevalent tools to interact with disks and filesystems
are free, dd, du, df, and
mount.

The free command displays information on memory. We can use
either the -m or -g options, to display the data in
mebibytes or in gibibytes,^[81] respectively.

kal@kali:~$ free -m
          total     used      free    shared  buff/cache   available
Mem:       1982      425       269         3        1287        1369
Swap:       974       15       959
Copy

Listing 39 - Using the free command to check information on memory

df^[82] (which stands for "disk free") reports on the
available disk space on each of the disks mounted in the file system.
Its -h option (for human readable) converts the sizes into a
more legible unit - usually mebibytes or gibibytes.

kali@kali:~$ df -h
Filesystem      Size  Used Avail Use% Mounted on
udev            958M     0  958M   0% /dev
tmpfs           199M  1.2M  198M   1% /run
/dev/sda1        19G   10G  7.7G  57% /
tmpfs           992M  8.0K  992M   1% /dev/shm
tmpfs           5.0M     0  5.0M   0% /run/lock
tmpfs           199M   68K  199M   1% /run/user/1000
Copy

Listing 40 - Using the df command to check disk space

There are a few other commands and options we can use as well.

• dd^[83] is mostly used to raw copy a device file on a block level.

• du^[84] can be used to determine the size of files and
  directories. The -hs option is typically used to make the output
  more human readable.

• df and its -T option can be used to show the type of the
  filesystem.

One of the key differences between Linux and other OSs, is that in
Linux we have to mount a filesystem before we can use it. Since
Linux systems have a single directory tree, if we were to insert a USB
drive (for example), we would need to create an associated location
somewhere in that tree. Creating that associated location is called
mounting.

The mount^[85] command can be used to display the currently
mounted filesystems and their types. It can also be used to mount
partitions or image disk files to a mount point.

Let's run the mount command with the -t option
to show a certain type of mounted filesystem. In this case, we'll
display the partitions formatted as ext4, which is the journaling file
system^[86] for this machine.

kali@kali:~$ mount -t ext4
/dev/sda1 on / type ext4 (rw,relatime,errors=remount-ro)
kali@kali:~$
Copy

Listing 41 - Using the mount command to display a mounted filesystem

Let's take this a step further and mount a USB drive. Since this
example involves a physical object in the form of a USB drive,
following along in this section may not be as straightforward as it is
in other sections of this Module.

Once we've inserted the USB drive, we'll need to run fdisk
with sudo privileges to gain some information about the drive
we just inserted.

kali@kali:~$ sudo fdisk -l
[sudo] password for kali: 

Disk /dev/sda: 20 GiB, 21474836480 bytes, 41943040 sectors
Disk model: VMware Virtual S
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0xb31f280c

Device     Boot    Start      End  Sectors  Size Id Type
/dev/sda1  *        2048 39942143 39940096   19G 83 Linux
/dev/sda2       39944190 41940991  1996802  975M  5 Extended
/dev/sda5       39944192 41940991  1996800  975M 82 Linux swap / Solaris

Disk /dev/sdb: 980 MiB, 1027604480 bytes, 2007040 sectors
Disk model: TD Classic 003C 
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x5381b121

Device     Boot Start     End Sectors  Size Id Type
/dev/sdb1  *       32 2007039 2007008  980M  b W95 FAT32
Copy

Listing 42 - Using fdisk to gain details about our USB drive.

The first part of the output, with 20 GiB of memory, is our local
machine. We also observe another disk listed here with 980 MiB of
memory. This is our USB drive. We'll also note the device location,
which is /dev/sdb1. This will come in handy later.

To continue, let's create a directory. It's common to use the
already existing /mnt directory for this, so we'll create a
subdirectory called /usb. Next, we'll run the mount
command and provide the location of the device as well as the
associated location on our directory tree. We can get the location
of the device, /dev/sdb1, from the output in Listing
42.

kali@kali:~$ sudo mkdir /mnt/usb

kali@kali:~$ sudo mount /dev/sdb1 /mnt/usb

kali@kali:~$ cd /mnt/usb

kali@kali:/mnt/usb$ ls -la
total 2100
drwxr-xr-x 3 root root   4096 Dec 31  1969 .
drwxr-xr-x 3 root root   4096 Jul  8 11:12 ..
-rwxr-xr-x 1 root root 817959 Feb 16 10:45 IMG_3396.jpg
-rwxr-xr-x 1 root root 739123 Feb 16 10:45 IMG_3794.jpg
-rwxr-xr-x 1 root root 426757 Feb 16 10:45 IMG_5042.jpg
-rwxr-xr-x 1 root root 130553 Feb 18  2019 Info.hex
Copy

Listing 43 - Mounting the USB drive and checking its contents

We successfully mounted our USB drive and once we navigate to the
location in the directory tree, we can check the contents of the
drive. The drive appears to be a series of pictures and an interesting
looking Info.hex file.

Finally, let's unmount the drive. Note that if we try to
unmount it from our current location, we'll run into an
error. We can quickly resolve this by changing directories and running
the command again.

kali@kali:/mnt/usb$ sudo umount /mnt/usb 
umount: /mnt/usb: target is busy.

kali@kali:/mnt/usb$ cd ~

kali@kali:~$ sudo umount /mnt/usb

kali@kali:~$ 
Copy

Listing 44 - Unmounting the USB drive.

The command runs successfully and our USB drive is unmounted.

Linux Basics I & II: Cumulative Exercise

This Learning Unit has the following Learning Objectives:

1. Demonstrate competency with file searching
2. Demonstrate competency with user administration
3. Demonstrate competency with file system manipulation
4. Demonstrate competency with task scheduling

This is a cumulative exercise that requires you to employ the
understanding and skills you have gained in the Linux Basics I & II
Modules to complete a set of objectives.

Scenario: You have gained initial access to a target Linux machine
during a penetration test. You now need to search for user files to
find anything that might help you gain additional access. Once you've
done this, you will need create an additional administrative user and
schedule a periodic backup callback script in case you lose access to
the machine.

Windows Basics I

In this Topic, we will cover the following Learning Units:

• Introduction to Windows
• Windows Shells
• Windows File System Navigation
• System Information and Environment Variables
• Managing Files from the Command Line
• Searching for Files and Text

Each learner moves at their own pace, but this Topic should take
approximately 8 hours to complete.

Linux vs Windows

This Learning Unit covers the following Learning Objectives:

1. Understand the architectural and design differences between Linux and Windows operating systems.
2. Begin to learn about the 'type' command on Windows.
3. Use the SSH protocol to connect to a remote Windows machine.

This Learning Unit will take approximately 45 minutes.

The Microsoft Windows Operating System, colloquially known as
Windows, is a family of Operating Systems developed by Microsoft
Corporation.

Windows is ubiquitous in the personal computer space and is also
often deployed on an enterprise scale both as both a desktop and
a server side OS. Understanding the inner workings of Windows is
essential for anyone interested in defending or attacking networks,
because it is very likely that Windows systems will be involved.

As attackers, we often find ourselves with low level privilege
access to a Windows host, and need to use it to obtain higher
privileges or further infiltrate the network. This is one of
many reasons it is essential to understand the basics of how to
administer a Windows system.

Many security professionals are more familiar with Linux because
several of its features make it ideal for security assessments and
operations. Due to Linux's common usage in the security space, it
will be helpful to begin our Windows exploration by comparing the two
operating systems.

There are many differences^[87] between Linux and
Windows, and here we only cover them at a very high level.

Open Source vs Closed Source - Perhaps the most important
difference between the two operating systems is that Linux is entirely
open-source, meaning anyone can see exactly what code makes it up.
Windows, on the other hand, is corporately owned and its source code
is closed, and only open to Microsoft developers and staff.

Free vs Paid - Linux, in general, is free. There are some
exceptions, for example, organizations that offer enterprise products
for a fee, like Red Hat.^[88] For the most part though,
Linux distributions are created for non-profit. All of Windows OS are
paid products.

Decentralized vs Centralized Authorship - While the Linux kernel
is considered to be a benevolent dictatorship,^[89] many
distributions are built way of crowdsourcing and common effort. Anyone
can make a merge request^[90] to many of the Linux
distributions, including Kali Linux.^[91]

Windows is entirely centralized under Microsoft. While many of their
developers may contribute to the platform, ultimately Microsoft, as an
organization, gets the final say on what features get development time
and which bugs get fixed.

Root vs Administrator - As demonstrated in the Linux Basics
Topics, the highest-permission account on a Linux system is root,
and has complete control over the machine.

On Windows, the Administrator account belongs to the user with the
highest permissions. However, many Windows processes that require
elevated permissions run under the context of a non-user account
called NT AUTHORITY\SYSTEM. As attackers, we would be equally
satisfied with remote access to Administrator or System accounts.

File Systems - With Linux, every object on the computer is
considered a file, and each file sits within a single hierarchical
directory structure where the root directory (/) is
the base of the hierarchy. When an external piece of hardware is
attached to the system, it is treated just like any other file. In
this context, printers are "files", USB sticks are "files", and even
external hard drives are just "files".

Windows uses the concepts of drives^[92] and
devices.^[93] Drives begin with a letter like "C:" or
"D:". Each drive can contain its own hierarchy of files, devices, and
directories. By default, the C: drive is the primary partition and
stores the operating system itself as well as all system files and
applications. When an external piece of hardware is attached to the
system, it is given its own new drive letter and is referred to as a
device.

Paths and Capitalization - Linux directories are denoted with
forward slashes (/). For example, /etc/passwd,
represents the passwd file in the etc folder.
Linux filenames are case sensitive, so /etc/passwd and
/etc/PASSWD would refer to different files.

Windows uses backslashes (\) to separate directories,
like C:\Windows\System32. Windows filenames are
not case sensitive, so C:\Windows\System32 and
C:\Windows\SYSTEM32 would refer to the same file.

/etc config vs Registry - Linux splits up where it stores
information related to applications and its kernel in the
/etc and /proc directories respectively. Windows
manages both application and system configurations centrally in the
Windows Registry.

CLI vs GUI design first - In general, most Linux distributions
prioritize the command line interface. This is one of the reasons
why it is the preferred OS of many security professionals. Windows is
designed primarily for the GUI user, which is why it is so often found
in enterprise environments.

Optimization vs Compatibility - Finally, Linux developers tend
to build their specific distributions in ways that optimize for the
purpose of that distribution. For example, Kali Linux is optimized for
penetration testing and other security tasks, so its developers focus
on that domain.

Windows is developed with a strong focus on backward compatibility,
as Microsoft does not want to introduce new features that invalidate
or break older versions of the software. Sometimes, backward
compatibility can cause security issues.

Windows Shells

This Learning Unit covers the following Learning Objectives:

1. Understand the different Windows Command Line Interfaces
2. Understand and apply the concept of "built-in" commands
3. Obtain familiarity with the "help" option

This Learning Unit will take approximately 50 minutes to complete.

In this Learning Unit, we'll cover the various Command-Line Interfaces (CLI)
available on Windows and introduce several key commands used to navigate
the system. We'll highlight any significant divergences from their
Linux counterparts.

While Windows may be primarily developed for its Graphical User
Interface (GUI), its command-line interfaces are arguably just
as powerful as those found on Linux. The command-line provides
flexibility, speed, and access to low-level functionality that
is sometimes not readily accessible via the GUI. In addition, in
scenarios when we are acting as an attacker, we might not be able to
get remote GUI access to a Windows target. These are among the many
reasons we need to become comfortable with the command line.

Windows comes with three different command-line interfaces: cmd.exe,
PowerShell, and WMIC. These separate programs are sometimes
incorrectly assumed to be identical, yet there are some important
differences between them.

As a side note, there is a fourth shell that Windows supports and is
a relatively recent addition. It is called the Windows Subsystem for
Linux (WSL),^[94] and it allows for a Linux-like environment
within Windows. We won't be covering this particular feature here,
but it is an exciting new component worth keeping an eye on.

The Command Prompt, cmd.exe,^[95] is a shell that
contains a defined set of commands that allow users to interact with
Win32^[96] objects and applications.

Just like Zsh or Bash, cmd.exe can be used to create
and manipulate files, navigate to directories, and run shell
scripts. On Windows, these scripts are referred to as batch
files.^[97]

Although useful, the Command Prompt is limited and cannot access some
of the Windows core system administration functions.

PowerShell^[98] is a task automation solution
comprised of a command-line shell, a scripting language, and a
configuration management framework. It is now cross-platform and can
be run on Linux and macOS as PowerShell Core. It is possible to run
all the commands that the Command Prompt supports as well as many
more. It is therefore a far more robust and flexible option for
interacting with the Windows OS.

Windows PowerShell is built on the .NET^[99] framework
and employs the use of cmdlets^[100] to run administrative
tasks. PowerShell can fully interface with the Component Object
Model (COM)^[101] and the Windows Management Instrumentation
(WMI),^[102] which gives users the ability to perform
administrative tasks on both local and remote Windows systems.

The command-line component of PowerShell can be started by invoking
the PowerShell.exe binary in a regular Command Prompt window.

The Windows Management Instrumentation Command-Line
(WMIC)^[103] utility provides a command-line interface
for Windows Management Instrumentation (WMI). WMI allows scripting
languages like VBScript and PowerShell to manage Windows systems
locally and remotely. It also allows for the sharing of information
between management applications.

In this Topic, we'll be focusing exclusively on the Command Prompt
utility. We'll take a deeper look into PowerShell within the Scripting Basics
topic

Let's begin with an exploration of the cmd.exe builtin commands. A
builtin is a function directly programmed into the shell. Similar to
Bash builtins, Windows cmd.exe has a large number of commands that are
programmed directly into the shell.

The first command to learn is help. When no arguments are provided,
help displays all the other builtin commands.

C:\>help
For more information on a specific command, type HELP command-name
ASSOC          Displays or modifies file extension associations.
ATTRIB         Displays or changes file attributes.
BREAK          Sets or clears extended CTRL+C checking.
BCDEDIT        Sets properties in boot database to control boot loading.
...
Copy

Listing 1 - Using the help command with no arguments

We can also provide help with the name of a second command as an
argument to obtain its usage information as output.

C:\>help time
Displays or sets the system time.

TIME [/T | time]

Type TIME with no parameters to display the current time setting and a prompt
for a new one.  Press ENTER to keep the same time.

If Command Extensions are enabled the TIME command supports
the /T switch which tells the command to just output the
current time, without prompting for a new time.
Copy

Listing 2 - Using the help command on time

In this case, the help command gives us an explanation of the
time command, including a few instructions on how we might
use it.

We could also use the /? shortcut to get information about
how to use a command. This is similar to the -h switch for
many Bash commands.

C:\>time /?
Displays or sets the system time.

TIME [/T | time]

Type TIME with no parameters to display the current time setting and a prompt
for a new one.  Press ENTER to keep the same time.

If Command Extensions are enabled the TIME command supports
the /T switch which tells the command to just output the
current time, without prompting for a new time.
Copy

Listing 3 - Invoking the HELP command on TIME with /?

The information here is identical to the output of help time.

There are too many built-in commands to go over each one, but let's
note a few of the most important for basic navigation, which we'll
explore in more depth later.

Table 1 - Built-in commands

Windows File System Navigation

This Learning Unit covers the following Learning Objectives:

1. Change working directories using the Windows command-line.
2. Display a list of files in the current directory using the Windows command-line.
3. Understand the standard layout of a Windows directory structure

This Learning Unit will take approximately 110 minutes to complete.

Changing directories on Windows is very similar to doing so in Zsh or
Bash. cd changes directories to the target path. In Linux, we can
use cd with no parameters to return to the user's home directory.
cd with the / parameter will return to the root directory of the
machine (not to be confused with the root user's home directory). On
Windows, we can use cd\ or cd/ to return to the root directory of
the current drive:

C:\Windows\Web>cd\

C:\>
Copy

Listing 4 - Using cd\ to navigate to C:\

Instead of cat, Windows has type.

C:\Users\Offsec>type file.txt
This is a file on Windows.
Copy

Listing 5 - Using the type command

Recall that Windows does not consider filenames to be case sensitive,
so file.txt and FILE.TXT reference the same file.
If there are spaces in a filename, we need to include the contents in
quotes.

C:\Users\Offsec>type "Spaces In Title.txt"
"This file has spaces in its title"
Copy

Listing 6 - Using the type command with spaces

The linux ls command displays the contents of the current working
directory. On Windows, we can use the dir command to display
the contents of the current working directory.

Note that unlike its Linux equivalent ls, dir is a builtin command.
ls is not a Bash builtin but is rather a separate binary that lives at
/usr/bin/ls on Kali.

C:\Users>dir
 Volume in drive C has no label.
 Volume Serial Number is 1234-5678

 Directory of C:\Users
 
05/24/2021  04:53 PM    <DIR>          .
05/24/2021  04:53 PM    <DIR>          ..
05/24/2021  04:53 PM    <DIR>          Offsec
05/24/2021  04:43 PM    <DIR>          Public
               0 File(s)              0 bytes
               2 Dir(s)  32,935,755,776 bytes free
Copy

Listing 7 - Using the DIR command

We can use the /A option with dir to display hidden
files.

C:\Users>dir /A
 Volume in drive C has no label.
 Volume Serial Number is 1234-5678

 Directory of C:\Users

05/24/2021  04:53 PM    <DIR>          .
05/24/2021  04:53 PM    <DIR>          ..
05/24/2021  04:53 PM    <SYMLINKD>     All Users [C:\ProgramData]
05/24/2021  04:53 PM    <DIR>          Default
05/24/2021  04:53 PM    <JUNCTION>     Default User [C:\Users\Default]
05/24/2021  04:53 PM               174 desktop.ini
05/24/2021  04:53 PM    <DIR>          Offsec
05/24/2021  04:48 PM    <DIR>          Public
               1 File(s)            174 bytes
               5 Dir(s)  32,934,400,000 bytes free

C:\Users>
Copy

Listing 8 - Using the DIR command

Finally, note that the A key^[104] works slightly
different in the Windows terminal compared to many of the Linux
shells. On Windows, A will cycle through a list of
pre-defined options. For example, if we write type f and then
start hitting A, it will cycle through whatever files begin
with the letter f in the current directory.

In this section, we will introduce the default windows directory
structure.^[105] As described earlier, the C:\ drive
is the root of the primary partition on Windows.

Typically, C:\ contains the following standard
directories and subdirectories: \,\PerfLogs,
\Program Files, \Program Files (x86),
\ProgramData, \Users, \Windows.

C:\>dir
 Volume in drive C has no label.
 Volume Serial Number is 523D-9369

 Directory of C:\

05/24/2021  04:53 PM     <DIR>          PerfLogs
05/24/2021  04:53 PM     <DIR>          Program Files
05/24/2021  04:53 PM     <DIR>          Program Files (x86)
05/24/2021  04:53 PM     <DIR>          Users
05/24/2021  04:53 PM     <DIR>          Windows
               1 File(s)        378,568 bytes
               5 Dir(s)  32,926,023,680 bytes free

C:\>
Copy

Listing 9 - Listing Directories under C:\

• \PerfLogs: This directory stores Windows performance logs, but
  it is usually empty on a default configuration of Windows.

• \Program Files: This directory is found on both 32-bit
  and 64-bit versions on Windows. On 32-bit editions, this is the only
  Program Files directory available, and it stores 32-bit
  programs. On 64-bit versions of Windows, this directory stores 64-bit
  programs.

• \Program Files (x86): This directory can be found on
  64-bit editions of Windows and stores 32-bit versions of programs.

• \ProgramData:^[106] This is a hidden
  directory that contains program data that is expected to be accessed
  by computer programs regardless of the logged-in user account.

• \Users: Every user who has logged in to the OS at least
  once will have a subdirectory created under their name in this
  directory.

• \Users\Public: This is a subdirectory of \Users
  and contains user data. It can be accessed by all users and is used
  to share files among them. It can also be accessed across the network
  from valid user accounts with remote access permissions.

• \Users\[UserName]\AppData: This is a hidden subdirectory
  of \Users. It stores application data and settings
  for every user. \AppData contains three additional
  subfolders, namely \Roaming, \Local, and
  LocalLow. \Roaming is used for network-based
  logins for roaming profiles and synchronizes the user's data
  when they login to the computer. The Windows per-user temporary
  directory,^[107] \Temp, can be found here
  under \Local.

• \Windows: This stores the main Windows installation and
  contains files related to the OS itself.

• \System, \System32, and \SysWOW64:
  These directories store dynamic-link library (DLL)^[108]
  files that execute the core features of Windows and the Windows API.
  The nomenclature^[109] for these directories can be a bit
  confusing. \System stores 16-bit DLLs and is usually empty
  on 64-bit editions of Windows because 16-bit applications cannot
  run on 64-bit OSs. \System32 stores either 32-bit or
  64-bit DLL files, depending on whether a 32-bit or 64-bit edition of
  Windows is running. \SysWOW64 is found only on 64-bit editions of
  Windows, and despite its name, stores 32-bit DLLs.

System Information and Environment Variables

This Learning Unit covers the following Learning Objectives:

1. List and use several binaries that can retrieve system information
2. Look up update, patch and hotfix information on a Windows machine
3. Understand the concept of, create, and modify environment variables

This Learning Unit will take approximately 115 minutes.

systeminfo.exe^[110] is a Windows binary capable of
extracting detailed configuration information about the system it is
run on. It can also be run against remote machines if provided the
/s option.

C:\>systeminfo

Host Name:                 Offsec-Machine
OS Name:                   Microsoft Windows 10 Pro
OS Version:                10.0.19041 N/A Build 19041
OS Manufacturer:           Microsoft Corporation
OS Configuration:          Standalone Workstation
OS Build Type:             Multiprocessor Free
Registered Owner:          Offsec
...
Copy

Listing 10 - Viewing a snippet of systeminfo

Though systeminfo is not a built-in command, we can still use the
/? option to query the program's usage information:

C:\>systeminfo /?

SYSTEMINFO [/S system [/U username [/P [password]]]] [/FO format] [/NH]

Description:
    This tool displays operating system configuration information for
    a local or remote machine, including service pack levels.

Parameter List:
    /S      system           Specifies the remote system to connect to.

    /U      [domain\]user    Specifies the user context under which
                             the command should execute.

    /P      [password]       Specifies the password for the given
                             user context. Prompts for input if omitted.

    /FO     format           Specifies the format in which the output
                             is to be displayed.
                             Valid values: "TABLE", "LIST", "CSV".

    /NH                      Specifies that the "Column Header" should
                             not be displayed in the output.
                             Valid only for "TABLE" and "CSV" formats.

    /?                       Displays this help message.

Examples:
    SYSTEMINFO
    SYSTEMINFO /?
    SYSTEMINFO /S system
    SYSTEMINFO /S system /U user
    SYSTEMINFO /S system /U domain\user /P password /FO TABLE
    SYSTEMINFO /S system /FO LIST
    SYSTEMINFO /S system /FO CSV /NH
Copy

Listing 11 - Viewing systeminfo help

Windows is capable of storing environment variables similar to those
found on Linux.

Some of the most frequently used Windows environment variables include
the following.

...

Table 2 - A few environment variables

In the Linux Basics , we learned that we could reference Bash or Zsh
environment variables with the $<VARIABLE-NAME> syntax. On Windows,
we need to wrap the variable name in percentage signs like so:
%<VARIABLE-NAME>%.

For example, we can use the echo command to retrieve our
username.

C:\>echo username
username

C:\>echo $username
$username

C:\>echo %username%
Offsec
Copy

Listing 12 - Echoing our Username

In listing 12, note that the first two commands
simply output the literal string provided to echo as input.

When the set^[111] command is used without
parameters, it will display all currently stored environment
variables.

C:\>set
ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\Offsec\AppData\Roaming
asl.log=Destination=file
CommonProgramFiles=C:\Program Files\Common Files
CommonProgramFiles(x86)=C:\Program Files (x86)\Common Files
CommonProgramW6432=C:\Program Files\Common Files
COMPUTERNAME=Offsec-Machine
ComSpec=C:\WINDOWS\system32\cmd.exe
DriverData=C:\Windows\System32\Drivers\DriverData
FPS_BROWSER_APP_PROFILE_STRING=Internet Explorer
FPS_BROWSER_USER_PROFILE_STRING=Default
HOMEDRIVE=C:
HOMEPATH=\Users\Administrator
LOCALAPPDATA=C:\Users\Offsec\AppData\Local
LOGONSERVER=\\Offsec-Machine
NUMBER_OF_PROCESSORS=8
OneDrive=C:\Users\Offsec\OneDrive
OS=Windows_NT
Path=C:\Windows\system32;C:\Windows;
...
Copy

Listing 13 - Viewing all Environment Variables with set

The set command can also be used to temporarily change the
value of an environment variable in the context of the current shell.
The setx^[112] command can be used to change a value
permanently by modifying the registry. We'll learn more about the
Windows registry in a section below.

The built-in functionality of many of the Windows Command Prompt
commands is limited compared to Unix shells like Bash. Microsoft
has developed a suite of tools that together help make up a robust
command-line environment for system administration, collectively
called the Sysinternals System Information Utilities. Note that
Sysinternals does not come with Windows by default, but we can
download it from Microsoft's website.^[113]

The number of programs included in the suite is quite large and far
beyond what we can cover here. Below, we'll go over just one of the
tools that can be useful for security assessors, psinfo. We
encourage you to explore the wide variety of other programs on your
own.

Upon executing any of the Sysinternals tools for the first time, we
will need to accept the End-User License Agreement (eula). The eula
can also be accepted via the command-line for each utility with the
/accepteula option. After we accept the eula, we can run
psinfo with no arguments or options. This will display some
vital local system information.

C:\Users\Offsec\Downloads\SysinternalsSuite>psinfo

PsInfo v1.78 - Local and remote system information viewer
Copyright (C) 2001-2016 Mark Russinovich
Sysinternals - www.sysinternals.com

System information for \\Offsec-Machine:
Uptime:                    1 day 3 hours 6 minutes 15 seconds
Kernel version:            Windows 10 Enterprise, Multiprocessor Free
Product type:              Professional
Product version:           6.3
Service pack:              0
Kernel build number:       19041
Registered organization:
Registered owner:          Offsec
IE version:                9.0000
System root:               C:\WINDOWS
Processors:                8
...
Copy

Listing 14 - Running psinfo

The psinfo tool is quite versatile, and can retrieve
information related to security, installed software, system patches,
disk volume, and more. It can even be used on a remote machine. We
leave it as an exercise to determine how to work with it further.
Remember to use /? if you get stuck.

Psinfo is not the only tool that can pull this info. It can be done
with PowerShell and wmic. We will cover those Topics later, but
exploring the functionality now, may help in the questions below.
Especially, if one tool fails to produce results.

Managing Files From the Command Line

This Learning Unit covers the following Learning Objectives:

1. Write text to standard output on a Windows terminal
2. Create, delete, move, and copy files and directories
3. Understand and create symbolic links on a Windows system

This Learning Unit will take approximately 50 minutes to complete.

Managing files with the Command Prompt is very similar to doing so
with Zsh or Bash, with a few syntactical and functional differences to
take note of.

We can write a new file with the echo command. As mentioned
in the previous section, type outputs the command to the
terminal instead of cat.

C:\Users\Offsec>echo "New File" > NewFile.txt

C:\Users\Offsec>type NewFile.txt
"New File"
Copy

Listing 15 - Using echo to write a new file and type to read

In listing 15, notice that the quotes were captured
by the echo command.

To create an empty file, we can execute echo with no
arguments and redirect error output to the filename we want to create:

C:\Users\Offsec>echo 2> EmptyFile.txt
Copy

Listing 16 - Using echo to write an empty file

In listing 16, the echo command isn't
directly responsible for producing the empty file. Instead, we're
using the 2> operator to redirect all errors triggered by
echo to the specified file. Since echo produces
no errors, the file gets created with no content. As an exercise
for the reader, go ahead and test out what happens if you execute
notacommand 2> File.txt.

The del command is similar to linux's rm, and will delete files.

C:\Users\Offsec>del EmptyFile.txt

C:\Users\Offsec>type EmptyFile.txt
The system cannot find the file specified.
Copy

Listing 17 - Deleting files with del

We can rename files with rename or ren, and we can
move them to a different directory with move.

C:\Users\Offsec>rename NewFile.txt RenamedFile.txt

C:\Users\Offsec>type RenamedFile.txt
"New File"

C:\Users\Offsec>move RenamedFile.txt .\Music
        1 file(s) moved.
Copy

Listing 18 - Renaming and moving files with ren and move

In listing 17, we first rename
NewFile.txt, and we notice that our content has been
preserved. Then we attempt to move the file to the \Music
directory. The error we receive is because we are trying to move it
to the absolute \Music folder rather than the relative
folder under our current working directory. We solve the issue
in listing 18 by using the dot (.) to
specify our current directory. We could have also used move
RenamedFile.txt C:\Users\Offsec\Music instead.

Similar to Linux's commands, mkdir and rmdir will
create and delete folders.

C:\Users\Offsec>mkdir ANewDirectory

C:\Users\Offsec>dir
 Volume in drive C has no label.
 Volume Serial Number is 523D-9369

 Directory of C:\Users\Offsec

05/24/2021  10:36 PM    <DIR>          ANewDirectory
05/24/2021  10:36 PM    <DIR>          Contacts
05/24/2021  10:36 PM    <DIR>          Desktop
...

C:\Users\Offsec>rmdir ANewDirectory

C:\Users\Offsec>dir
 Volume in drive C has no label.
 Volume Serial Number is 523D-9369

 Directory of C:\Users\Offsec
 
05/24/2021  10:36 PM    <DIR>          Contacts
05/24/2021  10:36 PM    <DIR>          Desktop
...
Copy

Listing 19 - Making and deleting directories with mkdir and rmdir

In listing 19, we create a new directory, verify
its existence with the dir command, and then delete it.
Finally we check that it has been deleted with dir once
again.

The rmdir commmand can also be used to delete a directory
that has content within it. To do so, we'll need to use the
/S option.

C:\Users\Offsec>mkdir ThisFolder

C:\Users\Offsec>echo Has Stuff > .\ThisFolder\HasStuff.txt

C:\Users\Offsec>rmdir .\ThisFolder
The directory is not empty.

C:\Users\Offsec>rmdir /S .\ThisFolder
.\ThisFolder, Are you sure (Y/N)? y
Copy

Listing 20 - Deleting a populated directory with /S

In listing 20, we create a directory and place
a text file within it. We tried to delete it without the /S
option, but we received an error. Once we properly invoked the
/S option, we got a prompt to double check that we really
wanted to delete the directory.

We can use copy to copy the contents of one file to a second
one.

C:\Users\Offsec>cd Music

C:\Users\Offsec\Music>dir
 Volume in drive C has no label.
 Volume Serial Number is 523D-9369

 Directory of C:\Users\Offsec\Music

05/24/2021  10:36 PM    <DIR>          .
05/24/2021  10:36 PM    <DIR>          ..
05/24/2021  10:36 PM                13 RenamedFile.txt
               1 File(s)             13 bytes
               2 Dir(s)  32,479,846,400 bytes free

C:\Users\Offsec\Music>copy RenamedFile.txt ThisIsntMusic.txt
        1 file(s) copied.

C:\Users\Offsec\Music>dir
 Volume in drive C has no label.
 Volume Serial Number is 523D-9369

 Directory of C:\Users\Offsec\Music

05/24/2021  10:36 PM    <DIR>          .
05/24/2021  10:36 PM    <DIR>          ..
05/24/2021  10:36 PM                13 RenamedFile.txt
05/24/2021  10:36 PM                13 ThisIsntMusic.txt
               2 File(s)             26 bytes
               2 Dir(s)  32,479,580,160 bytes free

C:\Users\Offsec\Music>fc RenamedFile.txt ThisIsntMusic.txt
Comparing files RenamedFile.txt and THISISNTMUSIC.TXT
FC: no differences encountered
Copy

Listing 21 - Copying files with copy and checking with fc

Here we copied the contents of RenamedFile.txt to a new file.
We used dir to check, but then introduce the fc
command which compares the contents of two files elegantly.

The xcopy and robocopy^[114] commands are more
robust versions of copy that are often used in batch scripts. While
xcopy has been deprecated, robocopy is very helpful because it has a
high tolerance for network interruptions. It also has several other
powerful features that are useful for security auditing.

Windows includes the ability to create soft and hard symbolic
links, similar to what you will find in Linux. A symbolic link
essentially points to another file or directory. A soft symbolic link
is the equivalent of a shortcut. That is, it redirects attempts to
connect to invoke the linked file back to the original.

A hard symbolic link makes it appear as though the referenced file or
directory actually exists in the same location as the link's location.
This can be useful when working with programs that require access to
specific files or directories.

The mklink command is used to create a symbolic link on Windows and
supports the creation of both soft and hard symbolic links. The first
argument to mklink is the name of the link, and the second
argument is the name of the target we want to link to.

To create a soft symbolic link to a text file we can execute
mklink with no additional options:

C:\Users\Offsec>echo This is the file we want to link to > fileToBeLinkedTo.txt

C:\Users\Offsec>type fileToBeLinkedTo.txt
This is the file we want to link to

C:\Users\Offsec>mklink softlink fileToBeLinkedTo.txt
symbolic link created for softlink <<===>> fileToBeLinkedTo.txt

C:\Users\Offsec>type softlink
This is the file we want to link to

C:\Users\Offsec>dir softlink
 Volume in drive C has no label.
 Volume Serial Number is 523D-9369

 Directory of C:\Users\Offsec

05/25/2021  09:23 PM    <SYMLINK>      softlink [fileToBeLinkedTo.txt]
               1 File(s)              0 bytes
               0 Dir(s)  32,479,338,496 bytes free
Copy

Listing 22 - Creating a symbolic link

Let's review this listing. First, we created a new text file and
create a symbolic link that points to it. When we invoke the symbolic
link with type, we get the output of the linked file. We then
use dir to check the symlink's filetype and notice that it is
called "<SYMLINK>".

Let's do the same exercise with a hard symbolic link. To create a
hardlink, we use the same syntax but also employ the /h
option.

C:\Users\Offsec>echo This is another file to link to > secondFile.txt

C:\Users\Offsec>type secondFile.txt
This is another file to link to

C:\Users\Offsec>mklink /h hardlink secondFile.txt
Hardlink created for hardlink <<===>> secondFile.txt

C:\Users\Offsec>type hardlink
This is another file to link to

C:\Users\Offsec>dir hardlink

05/25/2021  09:24 PM                34 hardlink
               1 File(s)             34 bytes
               0 Dir(s)  32,478,904,320 bytes free
Copy

Listing 23 - Creating a hard symbolic link

Notice that the hardlink file has a regular filetype and does
not contain the "<SYMLINK>" tag. If we were to change the contents
of secondFile.txt, hardlink would remain unchanged.

Searching For Files and Text

This Learning Unit covers the following Learning Objectives:

1. Find particular files using the Windows Command line
2. Enumerate a Windows directory structure
3. Search for specific strings of text in files

This Learning Unit will take approximately 115 minutes to complete.

In this section, we'll cover how to locate files in Windows. Windows doesn't
quite have an equivalent of Linux's find. However, we can still
search for files using a variety of other commands. In this section, we'll focus on
using dir, tree, and forfiles.

We're already familiar with dir. One of the options we
haven't explored yet is the /s option, which allows us to
search for any file in the given folder and any of its subfolders.
If we don't specify a parent directory, the search will begin at the
current working directory.

C:\Users\Offsec>dir /s trojan.txt
 Volume in drive C has no label.
 Volume Serial Number is 523D-9369

 Directory of C:\Users\Offsec\Documents

05/25/2021  08:35 PM             2,771 trojan.txt
               1 File(s)          2,771 bytes

     Total Files Listed:
               1 File(s)          2,771 bytes
               0 Dir(s)  32,443,052,032 bytes free
Copy

Listing 24 - Searching for a malicious file

Here we used dir /s to find some malware.^[115] If
only it was always this simple!

We can use the wildcard character (*) to search for all files with a
given extension. For example, if we want to search for all executables
in a given folder, we could do so like this.

C:\Users\Offsec>dir /s *.exe /p
 Volume in drive C has no label.
 Volume Serial Number is 523D-9369

 Directory of C:\Users\Offsec\AppData\Local\atom

05/25/2021  02:29 PM         1,709,096 Update.exe
               1 File(s)      1,709,096 bytes

 Directory of C:\Users\Offsec\AppData\Local\Discord

05/25/2021  11:43 PM         1,512,760 Update.exe
               1 File(s)      1,512,760 bytes
...
Copy

Listing 25 - Searching for all executable binaries

We use the /p switch, in listing 25, to
pause the print after the terminal page is full, so that we can browse
the output at the pace we prefer.

The tree command produces a rather striking visualization of
the directory structure.

C:\Users\Offsec>tree
Folder PATH listing
Volume serial number is 523D-9369
C:.
...
├───Links
├───Music
│   └───Artists
│       ├───Albums
│       │   ├───Songs
│       │   ├───Generated
│       │   └───MyMusic
├───SecretStuff
│   ├───Documents
│   ├───Firewalls
│   │   ├───DontCheckHere
│   ├───Databases
│   │   ├───VPNs
│   │   ├───Images
│   │   ├───Resources
│   │   └───Videos
│   ├───Intelligence
│   │   ├───Profiles
│   │   ├───Policies
│   │   └───Orientation
│   │       └───scripts
...
Copy

Listing 26 - Using tree to see the directory structure

We can use tree to easily search through a user's home
directory to find interesting files. The /F flag will display
any files that exist within each of the directories in the output.

The forfiles command is an expressive tool that can execute other
commands on a defined set of files. While forfiles is very versatile,
we'll focus here on its search capability.

In the following example, we'll use forfiles to find the
path of notepad.exe. We'll use several flags. /P
specifies where to begin our search. /S indicates that we
want to search recursively. /M points at what we want to
search for. /C executes a specified command. In this case, we
want to output the path of the file to our terminal.

C:\Users\Offsec>forfiles /P C:\Windows /S /M notepad.exe /c "cmd /c echo @PATH"
...
"C:\Windows\SysWOW64\notepad.exe"
ERROR: Access is denied for "C:\Windows\SysWOW64\Com\dmp\".
ERROR: Access is denied for "C:\Windows\SysWOW64\config\".
ERROR: Access is denied for "C:\Windows\SysWOW64\Configuration\".
ERROR: Access is denied for "C:\Windows\SysWOW64\FxsTmp\".
ERROR: Access is denied for "C:\Windows\SysWOW64\Msdtc\".
ERROR: Access is denied for "C:\Windows\SysWOW64\networklist\".
ERROR: Access is denied for "C:\Windows\SysWOW64\sru\".
ERROR: Access is denied for "C:\Windows\SysWOW64\Tasks\".
Copy

Listing 27 - Using forfiles to find the path of notepad.exe

While we succeeded in finding notepad's path, we notice that there are
some errors in the output. This is because forfiles can only search
through directories that the user executing it has permissions to
enter. We'll learn more about user permissions in a later section.

Now that we know how to search for files, we can turn towards
searching for text within files. We mentioned that Windows does
not have a Linux find command equivalent. In Linux, that
command is used to locate a file. Somewhat confusingly, in Windows the
find command is used to search for a string of text.

Let's use find to search for the string "password" in what
appears to be an important file.

C:\>find "password" C:\Users\Offsec\importantfile.txt

---------- C:\USERS\OFFSEC\IMPORTANTFILE.TXT
user: Johnny - password: George1984! 
Copy

Listing 28 - Finding the string 'password' in an important file

Just like Bash or Zsh, the Windows Command Prompt supports
redirection and piping.^[116] Using pipes, we can
execute find on the output of another command:

C:\Users\Offsec>type importantfile.txt |find "password"
user: Johnny - password: George1984!
Copy

Listing 29 - Piping the output of type to find

Even though the output in listings 28 and
29 are similar, it's important to understand that
the execution of the commands is not exactly the same.

In the former, find is scanning through the contents of
importantfile.txt itself. In the latter, on the other hand,
find is scanning through the output of type, which is printed
to the terminal.

This suggests that we can use find similar to how we would use Linux's
grep. Since find operates on text, and since terminal output is
text, we can effectivly use find on any output. For example, we can
use it to search for files in a directory, the same way we might use
ls | grep on Linux.

C:\Users\Offsec>dir | find "important"
05/25/2021  09:51 AM                39 importantfile.txt

C:\Users\Offsec>
Copy

Listing 30 - Finding the string 'password' in an important file

While the find command is useful, it doesn't contain the
full power of grep. For example, it doesn't support regular
expressions.^[117]

We can, however, use regular expressions with the findstr command.
Just like find, we can use findstr to search for a specific string.
However, it can also search for multiple strings at the same time.

When findstr is provided more than one space-delimited string,
it interprets the input as a logical OR. In other words, if findstr
is provided two strings as input, it will search for occurrences of
either of those strings.

In the following example, we search for the string "Johnny" OR the
string "password":

C:\Users\Offsec>findstr "Johnny password" importantfile.txt
user: Johnny - password: George1984!
Copy

Listing 31 - Using findstr

Notice how we successfully retrieve the output in listing
31. If findstr was instead trying to look for the
literal string "Johnny password", it wouldn't have reported results,
since importantfile.txt does not contain that exact string.

Sometimes the output of the commands we execute will fill up the
screen and scroll off it, making it difficult to grab exactly what
we are looking for. The more command allow us to conveniently view
the output. This is similar in behavior to the /P flag when
executed with dir, but more lets us scroll one line at a time, whereas
dir /P will scroll one "screen" at a time. Note that we can
pipe the output of other commands to more, just as we did above with
find.

There are several additional available to more to help manage output.
The best way to learn more is to practice using it and read the usage
information with /?.

The sort command can be used to order output in a variety of ways.
Lets say we have a text file full of unordered numbers, and we wish to
order the contents beginning with the highest number. We can use the
/R flag to do so.

First, we'll use type to check the contents of the file
before we start.

C:\>type numbers.txt
23
80
297
41
9

C:\>sort /R numbers.txt
297
80
41
23
9
Copy

Listing 32 - Using sort with the reverse option

As we hope is becoming clear, we can pass the output of other commands
to sort via a pipe.

Windows Basics II

In this Module, we will cover the following Learning Units:

• Windows access controls and security principles
• Windows local accounts & groups
• Windows permissions
• Windows processes
• Windows libraries
• The Windows Registry
• Windows scheduled tasks
• Windows disk utilities
• Windows Basics I & II - cumulative exercise

Windows Access Controls and Security Principles

This Learning Unit covers the following Learning Objectives:

1. Describe how Windows permissions differ from Linux permissions at a high level
2. Understand the concept of discretionary access control
3. Understand the concept of Windows Security Principals

This Learning Unit provides a gentle introduction to Windows
permissions, and describes how they are different from Unix-based
permission structures.

Before we dive into Windows, let's quickly review Linux's
Discretionary Access Control (DAC)^[118] model for
comparison. We've previously covered the concept that "everything is a
file". Each file has three possible permissions: read (r), write (w),
and execute (x). Each file also has three possible access categories:
owner, group, and world. For a given file, any combination of
permissions can be assigned to any combination of access categories.

Windows also uses a DAC model, but it is significantly more nuanced.
For this reason, we'll be keeping our exploration of Windows Access
Control relatively high level here.

Windows has more than three permissions, and it also defines more than
three access categories. Further, Microsoft places a heavy emphasis
on design for networked-based access, which increases the complexity.
Given this design emphasis, it's interesting to note that even the
base command to create and manage users on a Windows system is called
net.^[119]

We will be generalizing some of this material to make it more
equatable to the concepts covered in the Linux Basics Module but it is
important to highlight that the Windows concepts of users and
permissions are not identical to those of Linux. We're also going to
focus on local users and permissions in this section. We will cover
network-based users and permissions in future Modules.

We'll first cover the concept of security
principals^[120] in Windows. One might assume this
term refers to best practices or accepted procedures, but the term
principal (as opposed to principle) means agent or entity.
Essentially, a security principal is a subject that the operating
system can opt to (or not to) authenticate. Security principals are
not limited to human user accounts. They include automated accounts,
threads, processes, groups of users, and even parts of the OS itself.

Security principals are identified by security identifiers
(SIDs).^[121] SIDs are alpha-numeric codes that uniquely
identify principals on a Windows machine. Some SIDs are considered
well-known, and they identify the same principal on every Windows OS.
An example of a well-known SID is S-1-1-0, which belongs to the
Everyone group. This SID includes all users on the machine.

SIDs do not need to be of a constant length. Some are quite short (as
seen above), and others are much longer sequences of characters. We
can check the SID of our current user with the whoami command
by providing it the /user option:

C:\>whoami /user

USER INFORMATION
----------------

User Name                 SID
========================= ============================================
offsec-machine\offsec     S-1-5-21-2753864161-1776656122-2845895175-1001
Copy

Listing 1 - Checking our user's SID

Each hyphen-separated number is called a component, and each
component assigns values with specific meanings. For example, the 3rd
component of a SID indicates the principal's identifier authority.
In listing 1, the identifier authority is 5,
which indicates that the SID belongs to an individual account or a
group.

We won't delve into what each component means and their potential
values here. The important takeaway is that the security identifier
system provides Windows with a flexible and robust means of
categorizing and referring to different security principals.

One important concept that makes use of SIDs are access
control entries (ACEs)^[122] and access control lists
(ACLs).^[123] An ACL is generally a dictionary of trustees
and sets of permissions they've been assigned. In Windows, each
element of an ACL is an ACE. There are six types of ACEs, and each ACE
includes a SID, a set of access rights,^[124] and several
flags that each indicate different properties.

SIDs are also used by the Local Security Authority
(LSA)^[125] to assign access tokens^[126] to each
user when they log on to an operating system. An in-depth exploration
of the LSA and access tokens is beyond the scope of this Module. For
now, note that access tokens are protected objects containing a
user's SID and any rights that they have on the OS.

Windows User and Group Permissions

This Learning Unit covers the following Learning Objectives:

1. Understand and enumerate default Windows user accounts
2. Control user access on a Windows machine
3. Modify group membership on a Windows machine
4. Understand the concept of User Account Control
5. Impersonate users with the runas command

Windows comes with a standard set of default user and system accounts
on every installation of the OS. Here we will cover some of the most
important security related ones.

Administrator: Administrator is a user account designed for
the system administrator to manage the machine. Its SID is always
S-1-5-domain-500. The Administrator has full permissions on all files
and directories on the machine. This makes it an especially desired
target during penetration tests and security audits. It’s important to
note that the Administrator account is disabled by default on Windows
10. During initial account creation, another user account will usually
be assigned administrative permissions instead. Such permissions are
provided through membership to the Local Administrators group.

Guest: The Guest account lets non-users of the machine log
on temporarily with restrictive permissions. It belongs to the
Guests group, with SID S-1-5-32-546. By default, the Guest account
is disabled, but when enabled it often has a blank password. It's
important to note the implications from a security perspective because
if the guest account on a victim has been enabled, we can often log on
to it.

SYSTEM: The SYSTEM account is used by the OS to run services that
need elevated permissions. By default, it has all the permissions
of the Administrator, but it isn't supposed to be logged in to by a
human user. That being said, some exploits can allow us to execute
code in the context of its owner. If a process running as SYSTEM gets
exploited, we might be able to impersonate the SYSTEM user itself.

We can use the net command to add, remove, and modify user accounts
and group membership on a local or networked machine. The net command
contains a series of subcommands that each perform a specific function.

To invoke a subcommand, we provide it to net as an argument.
If we execute net with no arguments, we receive a list of its
subcommands as output.

C:\>net
The syntax of this command is:

NET
    [ ACCOUNTS | COMPUTER | CONFIG | CONTINUE | FILE | GROUP | HELP |
      HELPMSG | LOCALGROUP | PAUSE | SESSION | SHARE | START |
      STATISTICS | STOP | TIME | USE | USER | VIEW ]
Copy

Listing 2 - Executing net with no arguments

We can also get slightly more extensive usage information with net
help.

C:\>net help
The syntax of this command is:

NET HELP
command
     -or-
NET command /HELP

  Commands available are:

  NET ACCOUNTS             NET HELPMSG              NET STATISTICS
  NET COMPUTER             NET LOCALGROUP           NET STOP
  NET CONFIG               NET PAUSE                NET TIME
  NET CONTINUE             NET SESSION              NET USE
  NET FILE                 NET SHARE                NET USER
  NET GROUP                NET START                NET VIEW
  NET HELP

  NET HELP NAMES explains different types of names in NET HELP syntax lines.
  NET HELP SERVICES lists some of the services you can start.
  NET HELP SYNTAX explains how to read NET HELP syntax lines.
  NET HELP command | MORE displays Help one screen at a time.
Copy

Listing 3 - Executing net help

With administrative permissions, we can create a new local user on our
machine with net user.

C:\>net user /add Tristan greatpassword
The command completed successfully.

C:\>net user Tristan
User name                    Tristan
Full Name
Comment
User's comment
Country/region code          000 (System Default)
Account active               Yes
Account expires              Never

Password last set            5/25/2021 11:01:31 AM
Password expires             7/8/2021 11:01:31 AM
Password changeable          5/25/2021 11:01:31 AM
Password required            Yes
User may change password     Yes

Workstations allowed         All
Logon script
User profile
Home directory
Last logon                   Never

Logon hours allowed          All

Local Group Memberships      *Users
Global Group memberships     *None
The command completed successfully.
Copy

Listing 4 - Adding a new user and viewing their information

In listing 4, we created a new user with
the /add option, and provided a username and password. We
then use net user again to retrieve information about the
new account. We can verify if the account is enabled or not via the
"Account active" line. In this case, the account is enabled because we
just created it.

We can also use net to view and modify localgroup membership. A
localgroup is a set of accounts that can be assigned permissions on
a local machine. Let's use net localgroup to retrieve local
group information on our system.

C:\>net localgroup

Aliases for \\Offsec-Machine

-------------------------------------------------------------------------------
*Access Control Assistance Operators
*Administrators
*Backup Operators
*Cryptographic Operators
*Distributed COM Users
*Event Log Readers
*Guests
*Hyper-V Administrators
*IIS_IUSRS
*Network Configuration Operators
*Performance Log Users
*Performance Monitor Users
*Power Users
*Remote Desktop Users
*Remote Management Users
*Replicator
*System Managed Accounts Group
*Users
The command completed successfully.
Copy

Listing 5 - Executing net localgroup

Two important groups for security are Administrators and Remote
Desktop Users. Any member of Administrators has equivalent
permissions of the Administrator account, and any member of
Remote Desktop Users can access the machine remotely if Remote
Desktop^[127] is enabled. Often if an attacker gets
remote code execution on a machine with administrative privileges,
they will add a user to the system, add the new user to the Remote
Desktop Users group, and then log on to the machine remotely. This
provides them with full GUI access to the target.

Let's now add "Tristan" to the Administrators group with net
localgroup.

C:\>net localgroup Administrators Tristan /add
The command completed successfully.
Copy

Listing 6 - Adding Tristan to the Administrator group

Now we'll clean up by removing "Tristan" from the Administrators
group, and then deleting the account.

C:\>net localgroup Administrators Tristan /del
The command completed successfully.


C:\>net user /del Tristan
The command completed successfully.
Copy

Listing 7 - Removing Tristan from the Administrators group and deleting the account

Another useful net subcommand is accounts. We can use net
accounts to display or set account policies.

C:\>net accounts
Force user logoff how long after time expires?:       Never
Minimum password age (days):                          1
Maximum password age (days):                          90
Minimum password length:                              8
Length of password history maintained:                5
Lockout threshold:                                    4
Lockout duration (minutes):                           30
Lockout observation window (minutes):                 30
Computer role:                                        WORKSTATION
The command completed successfully.
Copy

Listing 8 - Viewing the current account policies

Finally, for completion's sake, we will mention the existence of
default security groups^[128]. We'll cover these
further in a future Module.

User Account Control(UAC)^[129] is another security
feature on Windows that has no standard Linux equivalent. Its purpose,
in general, is to protect against malicious actions by forcing an
active human user to manually confirm administrative actions by means
of a prompt, or message box.

The details of how UAC works are beyond the scope of this Module. For
our purposes, we want to highlight three important takeaways.

1. Windows SYSTEM and Administrator accounts aren't quite trusted
   with the same amount of power as root accounts on Unix-like machines.

2. UAC is one of Microsoft's methods of applying the Principle of
   Least Privilege (POLP). POLP says to give users, accounts, and systems
   access to only the things they need to get their job done.

3. The pop-up windows that UAC triggers are an important phenomenon
   for an attacker to be aware of. If an attacker triggers UAC with a
   malicious action, the active user will likely become aware of the
   attempt. Strong attackers have a good model of what actions can
   trigger UAC, so that they can better avoid it.

Windows comes with a command to impersonate another user called
runas. It's not nearly as powerful as sudo, but it can be used to
elevate privileges temporarily. Let's execute runas with no
arguments to show its usage information:

C:\>runas
RUNAS USAGE:

RUNAS [ [/noprofile | /profile] [/env] [/savecred | /netonly] ]
        /user:<UserName> program

RUNAS [ [/noprofile | /profile] [/env] [/savecred] ]
        /smartcard [/user:<UserName>] program

RUNAS /trustlevel:<TrustLevel> program

   /noprofile        specifies that the user's profile should not be loaded.
                     This causes the application to load more quickly, but
                     can cause some applications to malfunction.
   /profile          specifies that the user's profile should be loaded.
                     This is the default.
   /env              to use current environment instead of user's.
   /netonly          use if the credentials specified are for remote
                     access only.
   /savecred         to use credentials previously saved by the user.
   /smartcard        use if the credentials are to be supplied from a
                     smartcard.
   /user             <UserName> should be in form USER@DOMAIN or DOMAIN\USER
   /showtrustlevels  displays the trust levels that can be used as arguments
                     to /trustlevel.
   /trustlevel       <Level> should be one of levels enumerated
                     in /showtrustlevels.
   program         command line for EXE.  See below for examples

Examples:
> runas /noprofile /user:mymachine\administrator cmd
> runas /profile /env /user:mydomain\admin "mmc %windir%\system32\dsa.msc"
> runas /env /user:user@domain.microsoft.com "notepad \"my file.txt\""

NOTE:  Enter user's password only when prompted.
NOTE:  /profile is not compatible with /netonly.
NOTE:  /savecred is not compatible with /smartcard.
Copy

Listing 9 - Executing runas with no arguments

Since runas can execute commands with another user's
permissions, it can be useful for attackers to attempt it if they
obtain low-level access to a machine.

Another thing attackers can do with limited access to a target (say,
via remote command execution) is to invoke the cmd.exe binary
itself. So far, we've been running cmd.exe as a terminal with
legitimate permissions to do so. However, since cmd.exe is
a binary that can get executed like any other, a remote attacker may
be able to use it to execute individual arbitrary commands. We can do
this with the /c option, which runs the command it's provided
as an argument and then terminates immediately.

C:\>echo hi
hi

C:\>cmd /c echo hi
hi
Copy

Listing 10 - Demonstrating cmd /c usage

While the output of the two commands in listing
8 is the same, the executor of those commands
is different. The first command was executed by the cmd.exe
process running inside the terminal, but the second command started
another separate cmd.exe process, and this second process ran
echo.

runas is best used with a GUI interface, since it executes the
desired command under a different context than the shell that starts
it. Therefore, we'll be using the rdesktop utility on Kali Linux
to remotely connect to the Windows target GUI instead of our regular
SSH connection. The rdesktop syntax is: rdesktop -u USERNAME -p
PASSWORD IP-ADDRESS. The -f and -g switches may also be useful
for better visibility.

Introduction to Windows Permissions

This Learning Unit covers the following Learning Objectives:

1. Explore and understand the NTFS permissions structure
2. Understand how permissions can apply differently to files and directories
3. Understand the concept of inheritance

In this section, we'll begin to explore Window's New Technology
File System (NTFS)^[130] permission structure. Note that
this subject is very broad and we'll only be able to cover the basic
permissions. The important takeaway is, we want to be able to identify
and understand the various permissions so that we can eventually learn
to exploit any issues in the future.

Like Unix-based permissions, NTFS treats files and directories
slightly differently. Let's learn about them one at a time. The
following is the basic set of permissions assignable to files.

Read: Allows the user to view the contents of the file. Crucially,
read also allows users to execute scripts.

Write: Allows the user to write to the file. Note that write
does not allow a user to delete the file, though they can delete its
contents.

Read & Execute: Allows the user to read the file, as well as
execute binaries.

Modify: Allows the user to read and write to the file. Also allows
the user to delete it.

Full Control: Allows the user to read, write, change, or delete
the file.

Here is the basic set of permissions assignable to directories.

Read: Allows the user to view and list any file in the directory.

Write: Allows the user to add files or subfolders to the
directory.

Read & Execute: Allows the user to view and list any file or
subfolder in the directory, and also allows execution of any binary
within the folder.

List Folder Contents: Allows the user to list any file or
subfolder in the directory and also allows execution of any binary
within the folder. List Folder Contents appears at first glance very
similar to Read & Execute. The difference between them is that Read &
Execute allows for viewing the contents of files as well.

Modify: Allows the user to read, write and delete files and
subfolders within the directory.

Full Control: Allows the user to read, write, change, and delete
files and subfolders within the directory. Note that the Full
Control permission on a directory allows the user to delete all files
in it, even if they aren't assigned Modify or Full Control permissions
on the files themselves.

These basic permissions are made up of a larger set of
special permissions. These special permissions allow for more
granular control over what users can do. We can think of the special
permissions as building blocks that make up the basic ones, where
the basic ones are just the most frequently used combinations. It may
be useful to learn more about special permissions^[131]
outside what we can explain here.

One important concept to cover quickly is that of
inheritance.^[132] In general, inheritance allows
a parent entity to propagate attributes to its children. In the
case of NTFS, inheritance has to do with the permissions assigned to
a particular file or folder. By default, a particular file or folder
inherits the permissions of the folder it is contained within.

Let's now turn to some of the ways we can view and interact with
permissions on a Windows system. The icacls tool and its deprecated
predecessor, cacls, are built-in executables that can display and
modify permissions on files and folders.

We can view the icacls usage information by typing it at the
Command Prompt.

C:\>icacls

ICACLS name /save aclfile [/T] [/C] [/L] [/Q]
    stores the DACLs for the files and folders that match the name
    into aclfile for later use with /restore. Note that SACLs,
    owner, or integrity labels are not saved.

ICACLS directory [/substitute SidOld SidNew [...]] /restore aclfile
                 [/C] [/L] [/Q]
    applies the stored DACLs to files in directory.
...
Copy

Listing 11 - Viewing icacls usage information

Towards the bottom of the extensive usage information, we can see that
the various rights are coded with one to four characters:

    perm is a permission mask and can be specified in one of two forms:
        a sequence of simple rights:
                N - no access
                F - full access
                M - modify access
                RX - read and execute access
                R - read-only access
                W - write-only access
                D - delete access
        a comma-separated list in parentheses of specific rights:
                DE - delete
                RC - read control
                WDAC - write DAC
                WO - write owner
                S - synchronize
                AS - access system security
                MA - maximum allowed
                GR - generic read
                GW - generic write
                GE - generic execute
                GA - generic all
                RD - read data/list directory
                WD - write data/add file
                AD - append data/add subdirectory
                REA - read extended attributes
                WEA - write extended attributes
                X - execute/traverse
                DC - delete child
                RA - read attributes
                WA - write attributes
        inheritance rights may precede either form and are applied
        only to directories:
                (OI) - object inherit
                (CI) - container inherit
                (IO) - inherit only
                (NP) - don't propagate inherit
                (I) - permission inherited from parent container
Copy

Listing 12 - Viewing icacls usage information - continued

Here are some of the common options we might be interested in:

• /T executes the operation recursively on all subfolders

• /C forces the operation to continue despite any errors

• /L is used with symbolic links. It causes the operation to be
  executed on the link itself rather than its target.

We can supply a folder as input to icacls to view its
permissions.

C:\Users\Offsec>icacls Music
Music NT AUTHORITY\SYSTEM:(OI)(CI)(F)
      BUILTIN\Administrators:(OI)(CI)(F)
      Offsec-Machine\Offsec:(OI)(CI)(F)

Successfully processed 1 files; Failed processing 0 files
Copy

Listing 13 - Using icacls on the Music directory

Earlier, we started to learn about ACEs and ACLs. An ACE represents a
particular permission, and an ACL is just a list of the permissions.
In listing 13, each line of the output is
considered an ACE. The values in parentheses indicate the inheritance
properties and rights of the given user. For example, "(OI)" stands
for Object Inherit, which means the ACE will be inherited by files
and folders placed within the directory. In this case, all three users
of the machine are granted full access to the file because of the "F"
flag.

We can use the /grant and /deny options to provide
or remove rights to a file or folder.

c:\>icacls Music /grant Susan:(OI)(CI)(F)
processed file: Folder
Successfully processed 1 files; Failed processing 0 files

c:>icacls Music /t /c
Music NT AUTHORITY\SYSTEM:(OI)(CI)(F)
      BUILTIN\Administrators:(OI)(CI)(F)
      Offsec-Machine\Offsec:(OI)(CI)(F)
      Offsec-Machine\Susan:(OI)(CI)(F)

Music\RockAndRoll NT AUTHORITY\SYSTEM:(OI)(CI)(F)
                  BUILTIN\Administrators:(OI)(CI)(F)
                  Offsec-Machine\Offsec:(OI)(CI)(F)
                  Offsec-Machine\Susan:(OI)(CI)(F)
...
Copy

Listing 14 - Using icacls to grant permissions

In listing 14, we grant the user Susan with
full permissions to the Music directory. We then use the
/t option to check that the assigned permissions have been
propagated to children of the directory.

One of the many programs included in the Sysinternals suite is called
accesschk.exe, or simply AccessChk. AccessChk is a robust
auditing tool that can retrieve information on permissions across the
entire operating system.

Let's review the AccessChk usage information by invoking it
at the command line. Note that we need to supply the full path to the
file or execute it from the directory containing Sysinternals.

C:\Users\Offsec\Downloads\SysinternalsSuite>accesschk

Accesschk v6.13 - Reports effective permissions for securable objects
Copyright ⌐ 2006-2020 Mark Russinovich
Sysinternals - www.sysinternals.com

usage: accesschk [-s][-e][-u][-r][-w][-n][-v]-[f <account>,...][[-a]|[-k]|[-m]|[-p [-f] [-t]]|[-h][-o [-t <object type>]][-c]|[-d]] [[[-l|-L] [-i]]|[username]] <file, directory, event log, registry key, process, service, object>
   -a     Name is a Windows account right. Specify '*' as the name to show all
          rights assigned to a user. Note that when you specify a specific
          right, only groups and accounts directly assigned the right are
          displayed.
   -c     Name is a Windows Service e.g. ssdpsrv. Specify '*' as the
          name to show all services and 'scmanager' to check the security
          of the Service Control Manager.
   -d     Only process directories or top level key.
   -e     Only show explicitly set Integrity Levels (Windows Vista and
          higher only).
   -f     If following -p, shows full process token information including
          groups and privileges. Otherwise is a list of comma-separated
          accounts to filter from the output.
   -h     Name is a file or printer share. Specify '*' as the name to show
          all shares.
   -i     Ignore objects with only inherited ACEs when dumping full access
          control lists.
   -k     Name is a Registry key e.g. hklm\software
   -l     Show full security descriptor. Add -i to ignore inherited ACEs.
          Specify upper-case L to have the output format as SDDL.
   -m     Name is an event log (specify '*' as the name to show all event logs.
   -n     Show only objects that have no access.
   -o     Name is an object in the Object Manager namespace (default is root).
          To view the contents of a directory, specify the name with a trailing
          backslash or add -s. Add -t and an object type (e.g. section) to
          see only objects of a specific type.
   -p     Name is a process name or PID e.g. cmd.exe (specify '*' as the
          name to show all processes). Add -f to show full process
          token information including groups and privileges. Add -t to show
          threads.
   -nobanner
          Do not display the startup banner and copyright message.
   -r     Show only objects that have read access.
   -s     Recurse.
   -t     Object type filter e.g. "section"
   -u     Suppress errors.
   -v     Verbose (includes Windows Vista Integrity Level).
   -w     Show only objects that have write access.

If you specify a user or group name and path AccessChk will report the
effective permissions for that account; otherwise it will show the effective
access for accounts referenced in the security descriptor.

By default the path name is interpreted as a file system path (use the
"\pipe\" prefix to specify a named pipe path). For each object AccessChk
prints R if the account has read access, W for write access and nothing if
it has neither. The -v switch has AccessChk dump the specific
accesses granted to an account.
Copy

Listing 15 - Viewing accesschk usage information

We can view the rights of a specific security principal by providing
it as input to AccesssChk. Let's see what kind of permissions the
users group has on the C:\ drive:

c:\Users\Offsec\Desktop\SysinternalsSuite>accesschk.exe "users" c:\

Accesschk v6.13 - Reports effective permissions for securable objects
Copyright ⌐ 2006-2020 Mark Russinovich
Sysinternals - www.sysinternals.com

RW c:\$Recycle.Bin
R  c:\$WINDOWS.~BT
R  c:\bootmgr
R  c:\BOOTNXT
R  c:\Documents and Settings
   c:\MSOCache
c:\pagefile.sys
  Error getting security:
  The process cannot access the file because it is being used by another process.
   c:\PerfLogs
R  c:\Program Files
R  c:\Program Files (x86)
RW c:\ProgramData
R  c:\Python27
R  c:\Recovery
c:\swapfile.sys
  Error getting security:
  The process cannot access the file because it is being used by another process.
   c:\System Volume Information
R  c:\Users
R  c:\Windows
Copy

Listing 16 - Using accesschk to view permissions

The output of Listing 16 displays permissions
for the principal provided to AccessChk as input (in this case,
the users group). It displays an "R" if the principal has any read
permissions, a "W" if the principal has any write permissions, and
nothing if it has neither.

Remember that runas can be used to execute a file with someone
else's permissions.

Windows Processes

This Learning Unit covers the following Learning Objectives:

1. Understand the concept of process inheritance
2. Enumerate and understand key Windows Processes
3. List, start and end Windows processes using the command line

In this section, we'll cover Windows processes^[133].
A process is the container in which a program runs and a thread
is a single running instance of that program. Microsoft uses the
following analogy^[134] to describe the differences
between threads, processes, and programs:

• A process is like a room, and a thread is like a person in
  that room.
• A program is the set of instructions that the person in the
  room will follow.
• The thread is the thing happening, the process is the
  environment in which it happens, and the program is the procedure
  that the thread executes.

Before we dive into Windows processes, we need to understand that
there are two modes^[135] that an operating system can work
in: Kernel mode and User mode. Generally, a computer will switch
back and forth between these two modes, to execute many different
tasks in short periods. Kernel mode is for the most trusted operations
that the OS itself needs to execute. Processes running under Kernel
mode have access to the physical machine's underlying hardware. On the
other hand, User mode is for the vast majority of programs running on
the computer, but processes running in User mode do not have access to
the machine's hardware.

We mention this here because diving into Kernel-mode processes is well
beyond the scope of this Module. We will instead focus our attention on
User mode processes.

In this section, we'll discuss some of the core windows
processes^[136]^,^[137], how to view
them, and some ways to interact with them.

The functionality of different processes has changed over
different Windows versions. The following tour attempts to be as
version-agnostic as possible to keep the content at a high-level.

One important concept to understand before we dive in is
inheritance. We previously used the word inheritance to describe
how a subfolder or file can acquire the permissions of its parent
folder. In the context of processes, the idea is similar - if
ProcessOne starts ProcessTwo, we say that ProcessOne is the parent
of ProcessTwo, and that ProcessTwo is the child of ProcessOne.

To be considered a parent/child, the respective child/parent process
must still be alive. In other words, inheritance in this context
describes a relationship: both parent and child must be running to
maintain their relationship status.

As mentioned above, we won't cover kernel processes here, with one
exception. System is a Kernel-mode procedure responsible for core
operating system mechanisms. It makes sure that the OS can talk to the
machine's underlying hardware, and starts a cascade of other processes
that each perform key User mode functionality. In particular, it is
the parent of smss.exe. Another way to say this is that it
spawns smss.exe. On Windows 10, the System always has a
Process Identifier (PID)^[138] of 4. We'll learn how to find
PIDs of running processes shortly.

smss.exe: Session Manager is the first User mode process that's
started on a Windows machine. It is primarily responsible for
mapping out virtual address space.^[139] It is spawned
by System twice: one instance spawns winlogon.exe and
csrss.exe and then exits, and the other stays alive to watch
over the user's session. When it notices that winlogon.exe
or csrss.exe stop, it signals the OS to shutdown or crash,
depending on the reason for the halt.

winlogon.exe: Windows Logon is responsible for not
only authenticating users, but also for loading user
profiles. In addition, it performs an array of functions
even after login. For example, it listen's for the famous
C+E+H^[140] key sequence
that opens the security menu. Despite being started by another
process, Windows Logon has no parent, because it is spawned by
the instance of smss.exe that exits immediately upon its
creation. It is also the parent of userinit.exe, which
itself starts the user's initial shell and then exits. Usually,
userinit.exe starts explorer.exe.

csrss.exe: The Client Server Runtime Process is responsible for
several background functions. It begins the shutdown sequence when
terminated, and it is the parent of the process that eventually spawns
cmd.exe.

explorer.exe: Windows Explorer is responsible for rendering much
of the Windows GUI shell that the user interacts with. It governs
the Windows Start Menu, the Taskbar, and the System Tray. It is the
parent of several children processes, but it has no parent itself
because userinit.exe exits as soon as explorer.exe
is started.

wininit.exe: Windows Startup is responsible for triggering a
crucial set of User mode applications that must run to maintain the
system's stability and functionality. Windows Startup is the parent of
several children processes.

There are plenty of other essential Windows processes that we won't
get into here. In particular, we will cover server-related processes
like svchost.exe in later Modules.

Now that we've touched on some Windows processes, let's learn
about a few tools we can use to interact with them: tasklist and
taskkill. The tasklist command will list all running and
currently-suspended processes on the machine:

C:\>tasklist

Image Name                     PID Session Name        Session#    Mem Usage
========================= ======== ================ =========== ============
System Idle Process              0 Services                   0          8 K
System                           4 Services                   0        136 K
Registry                       124 Services                   0     34,532 K
smss.exe                       428 Services                   0      1,200 K
csrss.exe                      628 Services                   0      5,576 K
wininit.exe                    780 Services                   0      7,032 K
csrss.exe                      788 Console                    1      5,440 K
winlogon.exe                   888 Console                    1     12,120 K
services.exe                   948 Services                   0     10,264 K
lsass.exe                      968 Services                   0     22,064 K
svchost.exe                    668 Services                   0     28,920 K
...
Copy

Listing 17 - Using tasklist to view runnning processes

In listing 17, we can note a few things right
away. First, as mentioned above, System always runs with a PID of 4.
In addition, System Idle Process runs with a PID of 0. Essentially,
the Idle Process just runs when the OS has nothing else to spend
cycles on. We can also see a whole bunch of the processes we mentioned
above: smss.exe, csrss.exe, wininit.exe,
winlogon.exe, etc.

As usual, we can use the /? flag to print out the command's
usage information:

C:\>tasklist /?

TASKLIST [/S system [/U username [/P [password]]]]
         [/M [module] | /SVC | /V] [/FI filter] [/FO format] [/NH]

Description:
    This tool displays a list of currently running processes on
    either a local or remote machine.

Parameter List:
   /S     system           Specifies the remote system to connect to.

   /U     [domain\]user    Specifies the user context under which
                           the command should execute.

   /P     [password]       Specifies the password for the given
                           user context. Prompts for input if omitted.

   /M     [module]         Lists all tasks currently using the given
                           exe/dll name. If the module name is not
                           specified all loaded modules are displayed.

   /SVC                    Displays services hosted in each process.

   /APPS                   Displays Store Apps and their associated processes.

   /V                      Displays verbose task information.

   /FI    filter           Displays a set of tasks that match a
                           given criteria specified by the filter.

   /FO    format           Specifies the output format.
                           Valid values: "TABLE", "LIST", "CSV".

   /NH                     Specifies that the "Column Header" should
                           not be displayed in the output.
                           Valid only for "TABLE" and "CSV" formats.

   /?                      Displays this help message.

Filters:
    Filter Name     Valid Operators           Valid Value(s)
    -----------     ---------------           --------------------------
    STATUS          eq, ne                    RUNNING | SUSPENDED
                                              NOT RESPONDING | UNKNOWN
    IMAGENAME       eq, ne                    Image name
    PID             eq, ne, gt, lt, ge, le    PID value
    SESSION         eq, ne, gt, lt, ge, le    Session number
    SESSIONNAME     eq, ne                    Session name
    CPUTIME         eq, ne, gt, lt, ge, le    CPU time in the format
                                              of hh:mm:ss.
                                              hh - hours,
                                              mm - minutes, ss - seconds
    MEMUSAGE        eq, ne, gt, lt, ge, le    Memory usage in KB
    USERNAME        eq, ne                    User name in [domain\]user
                                              format
    SERVICES        eq, ne                    Service name
    WINDOWTITLE     eq, ne                    Window title
    MODULES         eq, ne                    DLL name
...
Copy

Listing 18 - Viewing tasklist usage information

One important option displayed in listing 18
is the /FI flag, which allows us to parse results based on
additional input. For example, we can view all processes running under
SYSTEM's user context is as follows:

C:\>tasklist /fi "USERNAME eq NT AUTHORITY\SYSTEM" /fi "STATUS eq running"

Image Name                     PID Session Name        Session#    Mem Usage
========================= ======== ================ =========== ============
csrss.exe                      788 Console                    1      5,448 K
NVDisplay.Container.exe       2892 Console                    1     46,768 K
rundll32.exe                  5388 Console                    1      7,280 K
...
Copy

Listing 19 - Using tasklist to view SYSTEM's running processes

As we learned in a previous section, the find command can
also be used to filter results based on an expected string:

C:\>tasklist /fi "imagename eq cmd.exe"

Image Name                     PID Session Name        Session#    Mem Usage
========================= ======== ================ =========== ============
cmd.exe                         84 Console                    1      4,408 K

C:\>tasklist |find "cmd.exe"
cmd.exe                         84 Console                    1      4,632 K
Copy

Listing 20 - Using tasklist and find to filter for cmd.exe

In listing 20, we first use tasklist's built-in
filter to find the cmd.exe process, and then we demonstrate
how to use find to replicate the results.

We can use the taskkill command to terminate a process by
specifying its process ID or image name. Let's review the
command's usage information first:

C:\>taskkill /?

TASKKILL [/S system [/U username [/P [password]]]]
         { [/FI filter] [/PID processid | /IM imagename] } [/T] [/F]

Description:
    This tool is used to terminate tasks by process id (PID) or image name.

Parameter List:
    /S    system           Specifies the remote system to connect to.

    /U    [domain\]user    Specifies the user context under which the
                           command should execute.

    /P    [password]       Specifies the password for the given user
                           context. Prompts for input if omitted.

    /FI   filter           Applies a filter to select a set of tasks.
                           Allows "*" to be used. ex. imagename eq acme*

    /PID  processid        Specifies the PID of the process to be terminated.
                           Use TaskList to get the PID.

    /IM   imagename        Specifies the image name of the process
                           to be terminated. Wildcard '*' can be used
                           to specify all tasks or image names.

    /T                     Terminates the specified process and any
                           child processes which were started by it.

    /F                     Specifies to forcefully terminate the process(es).

    /?                     Displays this help message.

Filters:
    Filter Name   Valid Operators           Valid Value(s)
    -----------   ---------------           -------------------------
    STATUS        eq, ne                    RUNNING |
                                            NOT RESPONDING | UNKNOWN
    IMAGENAME     eq, ne                    Image name
    PID           eq, ne, gt, lt, ge, le    PID value
    SESSION       eq, ne, gt, lt, ge, le    Session number.
    CPUTIME       eq, ne, gt, lt, ge, le    CPU time in the format
                                            of hh:mm:ss.
                                            hh - hours,
                                            mm - minutes, ss - seconds
    MEMUSAGE      eq, ne, gt, lt, ge, le    Memory usage in KB
    USERNAME      eq, ne                    User name in [domain\]user
                                            format
    MODULES       eq, ne                    DLL name
    SERVICES      eq, ne                    Service name
    WINDOWTITLE   eq, ne                    Window title
...
Copy

Listing 21 - Viewing taskkill's usage information

We can see in listing 21 that many of
taskkill's syntax and options are similar to those of tasklist. Let's
use taskkill to terminate the cmd.exe process. We
know from 20 that cmd.exe is running
as PID 84, so let's use that knowledge to end it:

C:\>taskkill /PID 84
Copy

Listing 22 - Terminating cmd.exe with taskkill

Upon successful completion of this command, the running Command Prompt
will exit!

The Sysinternals Suite contains several tools that can help us manage
and analyze processes. The pslist tool is like an enhanced
and more detailed version of tasklist. Let's check the usage
information with the standard /? flag:

C:\Users\Offsec\Downloads\SysinternalsSuite>pslist /?

PsList v1.4 - Process information lister
Copyright (C) 2000-2016 Mark Russinovich
Sysinternals - www.sysinternals.com

Usage: pslist [-d][-m][-x][-t][-s [n] [-r n] [\\computer [-u username][-p password][name|pid]
   -d          Show thread detail.
   -m          Show memory detail.
   -x          Show processes, memory information and threads.
   -t          Show process tree.
   -s [n]      Run in task-manager mode, for optional seconds specified.
               Press Escape to abort.
   -r n        Task-manager mode refresh rate in seconds (default is 1).
   \\computer  Specifies remote computer.
   -u          Optional user name for remote login.
   -p          Optional password for remote login. If you don't present
               on the command line pslist will prompt you for it if necessary.
   name        Show information about processes that begin with the name
               specified.
   -e          Exact match the process name.
   -nobanner   Do not display the startup banner and copyright message.
   pid         Show information about specified process.

All memory values are displayed in KB.
Abbreviation key:
   Pri         Priority
   Thd         Number of Threads
   Hnd         Number of Handles
   VM          Virtual Memory
   WS          Working Set
   Priv        Private Virtual Memory
   Priv Pk     Private Virtual Memory Peak
   Faults      Page Faults
   NonP        Non-Paged Pool
   Page        Paged Pool
   Cswtch      Context Switches
Copy

Listing 23 - Viewing pslist usage information

Running the command with no arguments produces a table like the
following:

C:\Users\Offsec\Downloads\SysinternalsSuite>pslist

PsList v1.4 - Process information lister
Copyright (C) 2000-2016 Mark Russinovich
Sysinternals - www.sysinternals.com

Process information for Offsec-Machine:

Name                Pid Pri Thd  Hnd   Priv        CPU Time    Elapsed Time
Idle                  0   0   8    0     60    46:18:25.765     6:07:07.039
System                4   8 175 3721    196     0:03:07.734     6:07:07.039
Registry            124   8   4    0   7288     0:00:02.734     6:07:08.716
smss                428  11   3   53   1096     0:00:00.187     6:07:07.030
csrss               628  13  15  503   2060     0:00:01.421     6:07:02.237
wininit             780  13   2  161   1476     0:00:01.625     6:07:01.361
csrss               788  13  15  623   2612     0:01:54.265     6:07:01.358
winlogon            888  13   5  276   2944     0:00:00.156     6:07:01.093
services            948   9   8  682   5368     0:00:03.812     6:06:58.275
lsass               968   9  10 1412   8564     0:00:03.421     6:06:58.238
svchost             668   8  22 1486  11432     0:00:06.406     6:06:57.973
...
Copy

Listing 24 - Running pslist

The output of listing 24 is already quite
detailed compared to that of tasklist. We can use the
-d switch to show information about threads running within
processes:

C:\Users\Offsec\Downloads\SysinternalsSuite>pslist -d

PsList v1.4 - Process information lister
Copyright (C) 2000-2016 Mark Russinovich
Sysinternals - www.sysinternals.com

Thread detail for Offsec-Machine:


Idle 0:
 Tid Pri    Cswtch            State     User Time   Kernel Time   Elapsed Time
   0   0  20580704          Running  0:00:00.000   5:41:55.015    0:00:00.000
   0   0   8235058          Running  0:00:00.000   6:01:26.484    0:00:00.000
   0   0  29415466          Running  0:00:00.000   5:44:02.046    0:00:00.000
   0   0  12082713          Running  0:00:00.000   6:03:30.343    0:00:00.000
   0   0  23820755          Running  0:00:00.000   5:53:34.890    0:00:00.000
   0   0   9787052          Running  0:00:00.000   6:00:18.078    0:00:00.000
   0   0  16211835          Standby  0:00:00.000   5:56:35.640    0:00:00.000
   0   0   7401098          Running  0:00:00.000   5:42:20.578    0:00:00.000

System 4:
 Tid Pri    Cswtch            State     User Time   Kernel Time   Elapsed Time
  12  13       180   Wait:Executive  0:00:00.000   0:00:00.000 3685291:31:42.659
  16  15        74   Wait:Executive  0:00:00.000   0:00:00.015 3685291:31:42.659
  20  15        46   Wait:Executive  0:00:00.000   0:00:00.000 3685291:31:42.659
  24  16        12   Wait:Executive  0:00:00.000   0:00:00.000 3685291:31:42.659
Copy

Listing 25 - Running pslist with the -d flag

In listing 25, we can view the threads running
under the Idle and System processes.

The -t switch provides us with tree-like output that exposes
child-parent relationships. Let's experiment with this by using our
current cmd.exe session to invoke another Command Prompt, and
then use pslist -t to analyze the results:

C:\Users\Offsec\Downloads\SysinternalsSuite>cmd
Microsoft Windows [Version 10.0.19041.985]
(c) Microsoft Corporation. All rights reserved.

C:\Users\Offsec\Downloads\SysinternalsSuite>pslist -t

PsList v1.4 - Process information lister
Copyright (C) 2000-2016 Mark Russinovich
Sysinternals - www.sysinternals.com

Process information for Offsec-Machine:
...
  cmd                          13352   8   2   85 4194303    5496    3452
    cmd                         6132   8   3   73 4194303    4620    4392
      pslist                   11292  13   4  222   62992    8484    3292
    conhost                    12772   8   7  320 4194303   26360   14436
...
Copy

Listing 26 - Running pslist with the -t flag

Listing 26 demonstrates that the newly-invoked
cmd.exe is a child of the original. It further shows that at
runtime, it was pslist's parent.

Just as Sysinternals has an equivalent for tasklist, so it does too
for taskkill. We can use the pskill tool to terminate local
and remote processes by supplying it with a PID or name.

Let's kill the second cmd.exe session we started in listing
26:

C:\Users\Offsec\Downloads\SysinternalsSuite>pskill 6132

PsKill v1.16 - Terminates processes on local or remote systems
Copyright (C) 1999-2016  Mark Russinovich
Sysinternals - www.sysinternals.com

Process 6132 killed.

C:\Users\Offsec\Downloads\SysinternalsSuite>pslist -t |find "cmd"
  cmd                          13352   8   2   86 4194303    5600    4216
Copy

Listing 27 - Running pskill

In listing 27 we provide pskill with
the PID of the second Command Prompt, which terminates the shell.
We then double-check with pslist that only one instance of
cmd.exe is running.

We can use pssuspend to either suspend or resume a process on a
local or remote system. This is useful for situations where we would
rather temporarily stop a process, rather than kill it completely.
If we supply no options to the command, it will suspend the provided
process, and if we supply the -r switch, it will resume the provided
process.

If we supply pssuspend with a specific process ID, it will suspend
or resume that particular process, but if we provide it with the
process's name, it will suspend or resume every instance of the
process.

For example, to suspend and then resume the chrome.exe
process we can type:

C:\Users\Offsec\Downloads\SysinternalsSuite>pssuspend chrome.exe

PsSuspend v1.07 - Process Suspender
Copyright (C) 2001-2016 Mark Russinovich
Sysinternals

Process chrome.exe suspended.

C:\Users\Offsec\Downloads\SysinternalsSuite>pssuspend -r chrome.exe

PsSuspend v1.07 - Process Suspender
Copyright (C) 2001-2016 Mark Russinovich
Sysinternals

Process chrome.exe resumed.
Copy

Listing 28 - Running pssuspend

Finally, let's cover one utility related to DLLs. We can use the
listdlls command to check which DLLs are called upon by various
processes. Let's run listdlls with no arguments. We'll need
to use C+c to stop the command since it will run for
some time otherwise:

C:\Users\Offsec\Downloads\SysinternalsSuite>listdlls

Listdlls v3.2 - Listdlls
Copyright (C) 1997-2016 Mark Russinovich
Sysinternals

...

winlogon.exe pid: 888
Command line: winlogon.exe

Base                Size      Path
0x000000001a840000  0xe3000   C:\WINDOWS\system32\winlogon.exe
0x0000000063970000  0x1f5000  C:\WINDOWS\SYSTEM32\ntdll.dll
0x0000000063140000  0xbd000   C:\WINDOWS\System32\KERNEL32.DLL
...
Copy

Listing 29 - Running listdlls with no arguments

The output of listing 29 expresses that
winlogon.exe is calling code from both ntdll.dll and
KERNEL32.DLL.

We can use the -u switch to list any
unsigned^[141] DLLs. This can be helpful to locate any
potentially untrusted code running on the system:

C:\Users\Offsec\Downloads\SysinternalsSuite>listdlls -u

Listdlls v3.2 - Listdlls
Copyright (C) 1997-2016 Mark Russinovich
Sysinternals

...

unsigned.exe pid: 4992
Command line: "unsigned.exe"

Base                Size      Path
0x0000000080000000  0x5000    C:\WINDOWS\system32\Unsigned2.dll
        Verified:       Unsigned
        Publisher:      2021-03-18 Offsec
        Description:    Example Unsigned DLL
        Product:        PEN-100
        Version:        1.3.3.7
        File version:   1.3.3.7
        Create time:    Sun Mar 18 20:11:25 2021
Copy

Listing 30 - Finding unsigned DLLs with listdlls

Windows Libraries

This Learning Unit covers the following Learning Objectives:

1. Understand the concept of Dynamic Link Libraries
2. Learn where to find DLLs stored on a Windows system
3. Enumerate several key DLLs used by Windows

Libraries are repositories of functions that can easily be
imported into other programs. Windows uses Dynamic-Link Libraries
(DLLs),^[108-1] which are themselves written in the
same format as .exe files. This helps eliminate reprogramming
the wheel, so to speak, and also creates a bedrock of community and
interdisciplinary collaboration. In this section, we'll cover some of the
DLLs are commonly invoked by various processes.

Windows makes use of a significant number of shared libraries, which
are called DLLs. DLLs contain code and data that can be called upon
at the same time by more than one program. DLLs essentially allow a
program to call upon already-written functionality instead of needing
to perform those functions itself.

On 64-bit versions of Windows, DLLs and system executables are stored
in System32 and SysWOW64. As we touched on in a
previous section, System32 contains 64-bit libraries and
SysWOW64 contains 32-bit libraries. On 32-bit version of
Windows, all system-wide libraries are located in System32.

Let's go over a shortlist of common Windows DLLs and their basic
functionality:

HAL.DLL: The Hardware Abstraction Layer is a Kernel-mode
library file and it cannot be used by any User-mode programs. It
performs multiple functions related to the system's underlying
hardware.

NTDLL.DLL: The New-Technology DLL allows User-mode programs
to call upon the Windows Native API.^[142] The Native API
is used when other more robust APIs are unavailable, such as during
system startup. For example, the aforementioned csrss.exe
calls upon NTDLL.DLL functionality.

KERNEL32.DLL: This DLL allows applications to call upon most
of the Win32 base APIs involving things like memory management, input
and output operations, and more. As an example of how DLLs can be used
by other code, KERNEL32.DLL itself implements much of its
functionality by calling upon NTDLL.DLL code.

USER32.DLL: Allows applications to call upon objects making
up the user interface, like the desktop, taskbar, and Start menu.

ADVAPI32.DLL: Allows applications to call upon security
features as well as functions that manipulate the Registry. We'll
discuss the Registry in detail in the following section.

There are many more DLLs that Windows runs on. It is outside the
scope of this Module to go through them all; however, we encourage you
to review this list^[143] should you be interested in
learning more about Windows core libraries.

Windows Registry

This Learning Unit covers the following Learning Objectives:

1. Understand the purpose and structure of the Windows Registry
2. Interact with the Registry using the Windows command-line
3. Understand and apply the concept of Registry values

In this section, we will learn about the structure of the Windows
Registry^[144] and how to interact with it.

The Windows Registry^[145] acts as a central
database for the OS. The Registry is important to understand from
a security perspective because it contains the most critical system
information. This information is constantly referenced by the OS
and by applications during startup as well as during regular system
operation.

Through the Registry, we can access both system information and user
information. In addition, we can use it to control which services and
applications get executed on the system.

A full exposition of the Registry is well beyond the scope of this
course so we'll be focusing on gathering a high-level understanding.
The basic unit of data within the Registry is called a key, which is
similar to a directory. The Registry uses a hierarchical structure, so
every key can contain additional subkeys or subdirectories, but they
can also contain specific values. Each value has a name, a data
type,^[146] and data content.

When an application wants to write data in the registry, it needs to
open the relevant key. To open a key, the application must provide the
name of the desired key to another, already opened key. We might ask
ourselves if this seems a bit circular: to open keys we seem to need
to open keys.

Windows solves this apparent paradox with the concept of predefined
keys^[147]. Predefined keys start and stay open, so
they can always be invoked by applications. Here is a list of some
of the predefined keys and a short description. For a more extensive
explanation of these keys, please see the resources section.

HKEY_CLASSES_ROOT (HKCR): Provides information related to file
types and properties. The subkeys under HKCR are often used by shell
applications (such as the Command Prompt) and by Component Object
Model (COM)^[101-1] applications.

HKEY_CURRENT_CONFIG (HKCC): Provides information related to the
hardware configurations upon which the OS is running, specifically
in comparison to the default configuration.

HKEY_CURRENT_USER (HKCU): Provides information related to the
setting configurations of the current user. Note that the HKCU key
and subkeys will be different depending on what user is logged in,
including SYSTEM.

HKEY_LOCAL_MACHINE: Provides information about the local machine
related to input/output devices, memory, and drivers.

HKEY_PERFORMANCE_DATA: Provides information related to system
performance. Notably, data associated with this key isn't stored
within the Registry itself but is rather referenced by Registry
functions^[148].

HKEY_USERS Provides information related to the default settings
assigned to new users.

To better organize keys and subkeys, the Registry employs the concept
of hives^[149]. A hive is a set of keys and their values.
Each hive has specific files associated with it that get loaded into
memory upon a trigger, for example, when the system is booted up or
when a user authenticates.

Microsoft provides the following table, which lists the standard hives
and their supporting files:

Table 1 - Default Hives and supporting files

Now that we've learned a little bit about the Registry's organization
and structure, we can turn towards using Windows tools to interact
with specific registry values.

There are too many different key values to cover here. We will point
out a few of them, and then apply some of the tools Windows comes with
to access keys, create keys and values, and delete values.
We'll also discuss exporting, which will be very important from a
security perspective.

The Run and RunOnce Registry keys allow applications to run upon
user authentication. In a nutshell, any program that is specified
as a value of one of these keys will be started once a user logs in.
Multiple programs can be included within the value of a given key.

By default, there are four Run and RunOnce keys, which live under
HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

The difference between the Run and RunOnce keys is that the values of
the latter will be deleted from the key as soon as the program(s) are
run.

We can use both the CLI and the GUI to interact with the Registry. The
graphical Registry Editor can be opened with the regedit command,
however, in this section, we'll focus on using the Command Prompt to
continue gathering familiarity and comfort with it.

Let's use the reg command to interact with the Registry and display
the values of the Run and RunOnce keys. Let's review the subcommands
of reg. They can be accessed with reg /?:

C:\>reg /?

REG Operation [Parameter List]

  Operation  [ QUERY   | ADD    | DELETE  | COPY    |
               SAVE    | LOAD   | UNLOAD  | RESTORE |
               COMPARE | EXPORT | IMPORT  | FLAGS ]

Return Code: (Except for REG COMPARE)

  0 - Successful
  1 - Failed

For help on a specific operation type:

  REG Operation /?

Examples:

  REG QUERY /?
  REG ADD /?
  REG DELETE /?
  REG COPY /?
  REG SAVE /?
  REG RESTORE /?
  REG LOAD /?
  REG UNLOAD /?
  REG COMPARE /?
  REG EXPORT /?
  REG IMPORT /?
  REG FLAGS /?
  
C:\>
Copy

Listing 31 - Using reg /?

The output of listing 31 outlines a long
list of actions we can perform with the registry. Let's follow the
instructions and find the usage for the query subcommand:

REG QUERY KeyName [/v [ValueName] | /ve] [/s]
          [/f Data [/k] [/d] [/c] [/e]] [/t Type] [/z] [/se Separator]
          [/reg:32 | /reg:64]

  KeyName  [\\Machine\]FullKey
           Machine - Name of remote machine, omitting defaults to the
                     current machine. Only HKLM and HKU are available on
                     remote machines
           FullKey - in the form of ROOTKEY\SubKey name
                ROOTKEY - [ HKLM | HKCU | HKCR | HKU | HKCC ]
                SubKey  - The full name of a registry key under the
                          selected ROOTKEY

  /v       Queries for a specific registry key values.
           If omitted, all values for the key are queried.

           Argument to this switch can be optional only when specified
           along with /f switch. This specifies to search in valuenames only.

  /ve      Queries for the default value or empty value name (Default).

  /s       Queries all subkeys and values recursively (like dir /s).

  /se      Specifies the separator (length of 1 character only) in
           data string for REG_MULTI_SZ. Defaults to "\0" as the separator.

  /f       Specifies the data or pattern to search for.
           Use double quotes if a string contains spaces. Default is "*".

  /k       Specifies to search in key names only.

  /d       Specifies the search in data only.

  /c       Specifies that the search is case sensitive.
           The default search is case insensitive.

  /e       Specifies to return only exact matches.
           By default all the matches are returned.

  /t       Specifies registry value data type.
           Valid types are:
             REG_SZ, REG_MULTI_SZ, REG_EXPAND_SZ,
             REG_DWORD, REG_QWORD, REG_BINARY, REG_NONE
           Defaults to all types.

  /z       Verbose: Shows the numeric equivalent for the type of the valuename.

  /reg:32  Specifies the key should be accessed using the 32-bit registry view.

  /reg:64  Specifies the key should be accessed using the 64-bit registry view.
...

C:\>
Copy

Listing 32 - Using reg query /?

Next, let's see if we can query the values of the Run and RunOnce keys
for our current user:

C:\>reg query hkcu\software\microsoft\windows\currentversion\runonce

C:\>reg query hkcu\software\microsoft\windows\currentversion\run

HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run
    OneDrive    REG_SZ    "C:\Users\OffSec\AppData\Local\Microsoft\OneDrive\OneDrive.exe" 
    
C:\>
Copy

Listing 33 - Using reg query on Run and RunOnce keys

Listing 33 shows that the RunOnce value is
set to empty. HKCU contains a single value for Run, "OneDrive.exe".
This allows OneDrive to start on login. The second column of the
output contains the string "REG_SZ". This column is used to indicate
the data type of the given value. For example, REG_SZ identifies a
null-terminated string, which means that the value should be text.

Next, let's use reg to remove the "OneDrive.exe" value from
the HKCU Run key.

C:\>reg delete hkcu\software\microsoft\windows\currentversion\run /va
Delete all values under the registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run (Yes/No)? yes
The operation completed successfully.

C:\>reg query hkcu\software\microsoft\windows\currentversion\run

C:\>
Copy

Listing 34 - Using reg delete

In listing 34, we use the /va option
to remove all values from the indicated key. Note that reg asks us
to explicitly confirm the deletion. Always make sure to double and
triple-check when modifying the registry.

Similarly, we can use the reg add subcommand to add values to
a key. We can give OneDrive.exe its rightful startup functions again
by adding it back to the HKCU Run key:

C:\>reg add hkcu\software\microsoft\windows\currentversion\run /v OneDrive /t REG_SZ /d "C:\Users\Offsec\AppData\Local\Microsoft\OneDrive\OneDrive.exe"
The operation completed successfully.

C:\>reg query hkcu\software\microsoft\windows\currentversion\run

HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run
    OneDrive    REG_SZ    C:\Users\Offsec\AppData\Local\Microsoft\OneDrive\OneDrive.exe

C:\>
Copy

Listing 35 - Using reg add

In Listing 35, we use the /v option to
name the value, /t to specify its data type, and /d
to supply the data. We can also use reg add to create a completely
new key.

Finally, let's cover the concept of exporting keys. We can save an
entire key or hive to a file with the reg export command:

C:\>reg export hkcu\environment environment
The operation completed successfully.

C:\>type environment
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\environment]
"Path"=hex(2):25,00,55,00,53,00,45,00,52,00,50,00,52,00,4f,00,46,00,49,00,4c,\
  00,45,00,25,00,5c,00,41,00,70,00,70,00,44,00,61,00,74,00,61,00,5c,00,4c,00,\
  6f,00,63,00,61,00,6c,00,5c,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,\
  00,74,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,41,00,70,00,70,00,\
  73,00,3b,00,00,00
"TEMP"=hex(2):25,00,55,00,53,00,45,00,52,00,50,00,52,00,4f,00,46,00,49,00,4c,\
  00,45,00,25,00,5c,00,41,00,70,00,70,00,44,00,61,00,74,00,61,00,5c,00,4c,00,\
  6f,00,63,00,61,00,6c,00,5c,00,54,00,65,00,6d,00,70,00,00,00
"TMP"=hex(2):25,00,55,00,53,00,45,00,52,00,50,00,52,00,4f,00,46,00,49,00,4c,00,\
  45,00,25,00,5c,00,41,00,70,00,70,00,44,00,61,00,74,00,61,00,5c,00,4c,00,6f,\
  00,63,00,61,00,6c,00,5c,00,54,00,65,00,6d,00,70,00,00,00
  
C:\>
Copy

Listing 36 - Using reg export

In Listing 36, we export the
HKEYCURRENT_USER\environment key to a file, and then output
its contents with type. A close look reveals that this key
contains three values expressed in _hexadecimal: Path, TEMP,
and TMP. Once we have exported a key, we can import it later or to
another machine with the reg import subcommand.

Hexadecimal is an important numerical system that is explored
in the Cryptography Module.

This is crucial from a security perspective, because depending on
the configurations and permissions of a machine, we may be able to
extract user password hashes by exporting the SAM and SYSTEM keys.

Windows has security mechanisms in place that prevent these keys from
being accessed while a machine is running, but in some circumstances,
these can be bypassed. A demonstration of these techniques is beyond
the scope of this Module. For now, we want to understand that the
Registry provides a wide and abundant attack surface that can allow an
attacker read and write capacities on extremely sensitive information.

Scheduling Tasks on Windows

This Learning Unit covers the following Learning Objectives:

1. Understand the purpose and normal use case for future-event scheduling
2. Schedule, modify and delete tasks using the Windows Task Scheduler on the command line
3. Recognize the security implications of task scheduling from an attacker's perspective

The Windows Task Scheduler^[150] allows us to schedule
computer programs or scripts to run at pre-defined times or upon
certain triggers. The scheduler has functionality that is similar
to cronjobs on Linux. As with the Registry, Windows comes with both
graphical and textual methods of interacting with the scheduler.
For our purposes, we'll focus on the CLI tool schtasks to continue
gaining proficiency and practice.

The schtasks command replaces the now deprecated at command. Let's
try running schtasks with the /? option to the
obtain usage information:

C:\>schtasks /?

SCHTASKS /parameter [arguments]

Description:
    Enables an administrator to create, delete, query, change, run and
    end scheduled tasks on a local or remote system.

Parameter List:
    /Create         Creates a new scheduled task.

    /Delete         Deletes the scheduled task(s).

    /Query          Displays all scheduled tasks.

    /Change         Changes the properties of scheduled task.

    /Run            Runs the scheduled task on demand.

    /End            Stops the currently running scheduled task.

    /ShowSid        Shows the security identifier corresponding to a scheduled task name.

    /?              Displays this help message.

Examples:
    SCHTASKS
    SCHTASKS /?
    SCHTASKS /Run /?
    SCHTASKS /End /?
    SCHTASKS /Create /?
    SCHTASKS /Delete /?
    SCHTASKS /Query  /?
    SCHTASKS /Change /?
    SCHTASKS /ShowSid /?
Copy

Listing 37 - Checking schtasks usage information

In Listing 37, we note that we can perform
several functions related to scheduling tasks, including creating,
deleting, changing, and even running tasks.

We can run schtasks /query or simply schtasks with
no arguments to view a list of all currently scheduled tasks:

C:\>schtasks

Folder: \
TaskName                                 Next Run Time          Status
======================================== ====================== ===============
MicrosoftEdgeUpdateTaskMachineCore       2021-06-06 8:12:08 AM  Ready
MicrosoftEdgeUpdateTaskMachineCore1d6c13 2021-06-05 10:08:35 PM Ready
MicrosoftEdgeUpdateTaskMachineUA         2021-06-05 11:38:35 AM Ready
OneDrive Standalone Update Task-S-1-5-21 2021-06-05 9:49:31 PM  Ready
...
Copy

Listing 38 - Viewing currently scheduled tasks

To create a new task, we can use the /create option:

C:\>schtasks /create /?

SCHTASKS /Create [/S system [/U username [/P [password]]]]
    [/RU username [/RP password]] /SC schedule [/MO modifier] [/D day]
    [/M months] [/I idletime] /TN taskname /TR taskrun [/ST starttime]
    [/RI interval] [ {/ET endtime | /DU duration} [/K] [/XML xmlfile] [/V1]]
    [/SD startdate] [/ED enddate] [/IT | /NP] [/Z] [/F] [/HRESULT] [/?]

Description:
    Enables an administrator to create scheduled tasks on a local or
    remote system.

Parameter List:
    /S   system        Specifies the remote system to connect to. If omitted
                       the system parameter defaults to the local system.

    /U   username      Specifies the user context under which SchTasks.exe
                       should execute.

    /P   [password]    Specifies the password for the given user context.
                       Prompts for input if omitted.

    /RU  username      Specifies the "run as" user account (user context)
                       under which the task runs. For the system account,
                       valid values are "", "NT AUTHORITY\SYSTEM"
                       or "SYSTEM".
                       For v2 tasks, "NT AUTHORITY\LOCALSERVICE" and
                       "NT AUTHORITY\NETWORKSERVICE" are also available as well
                       as the well known SIDs for all three.

    /RP  [password]    Specifies the password for the "run as" user.
                       To prompt for the password, the value must be either
                       "*" or none. This password is ignored for the
                       system account. Must be combined with either /RU or
                       /XML switch.

    /SC   schedule     Specifies the schedule frequency.
                       Valid schedule types: MINUTE, HOURLY, DAILY, WEEKLY,
                       MONTHLY, ONCE, ONSTART, ONLOGON, ONIDLE, ONEVENT.

    /MO   modifier     Refines the schedule type to allow finer control over
                       schedule recurrence. Valid values are listed in the
                       "Modifiers" section below.

    /D    days         Specifies the day of the week to run the task. Valid
                       values: MON, TUE, WED, THU, FRI, SAT, SUN and for
                       MONTHLY schedules 1 - 31 (days of the month).
                       Wildcard "*" specifies all days.

    /M    months       Specifies month(s) of the year. Defaults to the first
                       day of the month. Valid values: JAN, FEB, MAR, APR,
                       MAY, JUN, JUL, AUG, SEP, OCT, NOV, DEC. Wildcard "*"
                       specifies all months.

    /I    idletime     Specifies the amount of idle time to wait before
                       running a scheduled ONIDLE task.
                       Valid range: 1 - 999 minutes.

    /TN   taskname     Specifies the string in the form of path\name
                       which uniquely identifies this scheduled task.

    /TR   taskrun      Specifies the path and file name of the program to be
                       run at the scheduled time.
                       Example: C:\windows\system32\calc.exe

    /ST   starttime    Specifies the start time to run the task. The time
                       format is HH:mm (24 hour time) for example, 14:30 for
                       2:30 PM. Defaults to current time if /ST is not
                       specified.  This option is required with /SC ONCE.

    /RI   interval     Specifies the repetition interval in minutes. This is
                       not applicable for schedule types: MINUTE, HOURLY,
                       ONSTART, ONLOGON, ONIDLE, ONEVENT.
                       Valid range: 1 - 599940 minutes.
                       If either /ET or /DU is specified, then it defaults to
                       10 minutes.

    /ET   endtime      Specifies the end time to run the task. The time format
                       is HH:mm (24 hour time) for example, 14:50 for 2:50 PM.
                       This is not applicable for schedule types: ONSTART,
                       ONLOGON, ONIDLE, ONEVENT.

    /DU   duration     Specifies the duration to run the task. The time
                       format is HH:mm. This is not applicable with /ET and
                       for schedule types: ONSTART, ONLOGON, ONIDLE, ONEVENT.
                       For /V1 tasks, if /RI is specified, duration defaults
                       to 1 hour.

    /K                 Terminates the task at the endtime or duration time.
                       This is not applicable for schedule types: ONSTART,
                       ONLOGON, ONIDLE, ONEVENT. Either /ET or /DU must be
                       specified.

    /SD   startdate    Specifies the first date on which the task runs. The
                       format is yyyy/mm/dd. Defaults to the current
                       date. This is not applicable for schedule types: ONCE,
                       ONSTART, ONLOGON, ONIDLE, ONEVENT.

    /ED   enddate      Specifies the last date when the task should run. The
                       format is yyyy/mm/dd. This is not applicable for
                       schedule types: ONCE, ONSTART, ONLOGON, ONIDLE, ONEVENT.

    /EC   ChannelName  Specifies the event channel for OnEvent triggers.

    /IT                Enables the task to run interactively only if the /RU
                       user is currently logged on at the time the job runs.
                       This task runs only if the user is logged in.

    /NP                No password is stored.  The task runs non-interactively
                       as the given user.  Only local resources are available.

    /Z                 Marks the task for deletion after its final run.

    /XML  xmlfile      Creates a task from the task XML specified in a file.
                       Can be combined with /RU and /RP switches, or with /RP
                       alone, when task XML already contains the principal.

    /V1                Creates a task visible to pre-Vista platforms.
                       Not compatible with /XML.

    /F                 Forcefully creates the task and suppresses warnings if
                       the specified task already exists.

    /RL   level        Sets the Run Level for the job. Valid values are
                       LIMITED and HIGHEST. The default is LIMITED.

    /DELAY delaytime   Specifies the wait time to delay the running of the
                       task after the trigger is fired.  The time format is
                       mmmm:ss.  This option is only valid for schedule types
                       ONSTART, ONLOGON, ONEVENT.

    /HRESULT           For better diagnosability, the process exit code
                       will be in the HRESULT format.

    /?                 Displays this help message.

Modifiers: Valid values for the /MO switch per schedule type:
    MINUTE:  1 - 1439 minutes.
    HOURLY:  1 - 23 hours.
    DAILY:   1 - 365 days.
    WEEKLY:  weeks 1 - 52.
    ONCE:    No modifiers.
    ONSTART: No modifiers.
    ONLOGON: No modifiers.
    ONIDLE:  No modifiers.
    MONTHLY: 1 - 12, or
             FIRST, SECOND, THIRD, FOURTH, LAST, LASTDAY.

    ONEVENT:  XPath event query string.
...
Copy

Listing 39 - Checking schtasks /create help

Listing 39 demonstrates that schtasks is quite
flexible, particularly due to the presence of several options. /SC
allows us to set the tasks frequency not only based on a specific time
interval but also based on a particular trigger.^[151]
Examples of triggers include when the machine starts when a user
logs on, or when a particular event occurs. /MO allows us to lend
additional precision to time-based triggers. We can see all allowed
modifiers at the bottom of the listing.

As an example, let's imagine we wish to run a binary called
runme.exe every Monday at 9:00AM:

C:\>schtasks /create /sc weekly /d mon /tn runme /tr C:\runme.exe /st 09:00
SUCCESS: The scheduled task "runme" has successfully been created.
Copy

Listing 40 - Creating a new scheduled task

We can then delete the task as follows:

C:\>schtasks /delete /tn runme
WARNING: Are you sure you want to remove the task "runme" (Y/N)? y
SUCCESS: The scheduled task "runme" was successfully deleted.
Copy

Listing 41 - Deleting the scheduled task

Let's recreate that scheduled tasks and run some additional commands
against it to get a better understanding of the functionality of
schtasks.

C:\>schtasks /create /sc weekly /d mon /tn runme /tr C:\runme.exe /st 09:00
SUCCESS: The scheduled task "runme" has successfully been created.
Copy

Listing 42 - Recreating the new scheduled task

Now that the task is created we can use the query parameter
and the /fo LIST parameter to output the results in a list.

C:\>schtasks /query /TN runme /fo LIST 

Folder: \
HostName:      WINDOWS-03
TaskName:      \runme
Next Run Time: 6/06/2021 9:00:00 AM
Status:        Ready
Logon Mode:    Interactive only
Copy

There are plenty of wonderful resources available to learn about
additional parameters that allow you to work on remote computers, run
a task with the permissions of a different users. You can also adjust
the output as a table, list or csv, or adjust formatting to remove
column headings or provide more verbose output.^[152]

The task scheduler provides some powerful automation tools for a
legitimate user, but it also represents a versatile attack vector.
If we obtain sufficient permissions on a machine, we can use our
access to schedule repetitive malicious actions. If the machine
is misconfigured, we might even be able to elevate our permissions
by using the /RU option to run a task under the context of a
other users (for example, Administrator), in combination with the
/SC option to set a predictable trigger (for example, when the
Administrator logs in).

Windows Disk Utilities

This Learning Unit covers the following Learning Objectives:

1. Obtain drive information via the Windows command line
2. Understand the concept of alternate data streams
3. Recognize the functionalities an attacker can employ using alternate data streams

In this section, we'll go over how to interact with the Windows
New-Technology File System (NTFS)^[153] and
specifically how to use disk utilities to obtain drive information.
We'll then learn the concept of alternate data streams.

The Windows NTFS file system is more complex than Unix-based
equivalents. According to Microsoft, NTFS provides increased
reliability, flexibility, and security compared to its predecessor,
FAT32.^[154] A detailed exposition of the file system is
beyond the scope of this Module. Instead, we'll focus on a few default
tools and some Sysinternals tools that we can use to retrieve helpful
information about disk usage.

In terms of built-in utilities, Windows comes with the
fsutil^[155] set of programs that can manage drives. We
can see the full list of tools included in the suite by invoking the
command with no parameters:

C:\>fsutil
---- Commands Supported ----

8dot3name         8dot3name management
behavior          Control file system behavior
dax               Dax volume management
dirty             Manage volume dirty bit
file              File specific commands
fsInfo            File system information
hardlink          Hardlink management
objectID          Object ID management
quota             Quota management
repair            Self healing management
reparsePoint      Reparse point management
storageReserve    Storage Reserve management
resource          Transactional Resource Manager management
sparse            Sparse file control
tiering           Storage tiering property management
transaction       Transaction management
usn               USN management
volume            Volume management
wim               Transparent wim hosting management
Copy

Listing 43 - Viewing the fsutil commands

Many of the terms in Listing 43 may sound somewhat
arcane at this point. We do not need to go into great detail for our
purposes and will focus on a few subcommands.

Note that the /? option does not work with fsutil.
Instead, we'll need to reference a particular subcommand with no
additional arguments to understand what it does. Let's begin with
fsutil fsinfo, which can provide specific drive information.
Typing fsutil fsinfo without any arguments will provide a
third layer of subcommands:

C:\>fsutil fsinfo
---- FSINFO Commands Supported ----

drives          List all drives
driveType       Query drive type for a drive
ntfsInfo        Query NTFS specific volume information
refsInfo        Query REFS specific volume information
sectorInfo      Query sector information
statistics      Query file system statistics
volumeInfo      Query volume information
Copy

Listing 44 - Viewing the fsutil fsinfo commands

We can find all the drives on our machine with the drives
subcommand:

C:\>fsutil fsinfo drives

Drives: C:\ F:\ Z:\
Copy

Listing 45 - Listing out drives

In Listing 45, we observe that there are three
drives mounted on this machine. Let's examine the individual drives
with the drivetype subcommand:

C:\>fsutil fsinfo drivetype C:
C: - Fixed Drive

C:\>fsutil fsinfo drivetype F:
F: - CD-ROM Drive

C:\>fsutil fsinfo drivetype Z:
Z: - Fixed Drive
Copy

Listing 46 - Listing out drive types

Listing 46 tells us that the C: and Z: drives are
fixed to the machine, whereas the F: drive is a removable CD-ROM
drive. To retrieve more extensive information about the drives we can
use the volumeinfo subcommand:

C:\>fsutil fsinfo volumeinfo C:
Volume Name :
Volume Serial Number : 0x51324363
Max Component Length : 255
File System Name : NTFS
Is ReadWrite
Not Thinly-Provisioned
Supports Case-sensitive filenames
Preserves Case of filenames
Supports Unicode in filenames
Preserves & Enforces ACL's
Supports file-based Compression
Supports Disk Quotas
Supports Sparse files
Supports Reparse Points
Returns Handle Close Result Information
Supports POSIX-style Unlink and Rename
Supports Object Identifiers
Supports Encrypted File System
Supports Named Streams
Supports Transactions
Supports Hard Links
Supports Extended Attributes
Supports Open By FileID
Supports USN Journal
Copy

Listing 47 - Listing out information about the C: drive

Listing 47 confirms that our C: drive is indeed
formatted for NTFS, and provides us with a broad overview of its
properties.

While fsinfo and more generally, fsutil both have plenty of other
subcommands and functions, they do not tend to be needed for learning
the initial basics of penetration testing or security. We encourage
you to review Microsoft's documentation if you are further interested
in this broad subject.

During a security assessment, we might want a quick way of viewing
disk usage via the command-line. Windows doesn't come with Linux's
du^[156] command for estimating file space usage,
but Sysinternals^[157] does provide its own
implementation. We can use du.exe to report on disk usage:

C:\Users\Offsec\Downloads\SysinternalsSuite>du

DU v1.62 - Directory disk usage reporter
Copyright (C) 2005-2018 Mark Russinovich
Sysinternals - www.sysinternals.com

usage: du [-c[t]] [-l <levels> | -n | -v] [-u] [-q] <directory>
   -c     Print output as CSV. Use -ct for tab delimiting.
          Use -nobanner to suppress banner.
   -l     Specify subdirectory depth of information (default is one level).
   -n     Do not recurse.
   -q     Quiet.
   -nobanner
          Do not display the startup banner and copyright message.
   -u     Count each instance of a hardlinked file.
   -v     Show size (in KB) of all subdirectories.

CSV output is formatted as:
Path,CurrentFileCount,CurrentFileSize,FileCount,DirectoryCount,DirectorySize,DirectorySizeOnDisk
Copy

Listing 48 - Viewing du usage information

To view the usage of a particular drive, we provide it as input to
du:

C:\Users\Offsec\Downloads\SysinternalsSuite>du c:

DU v1.62 - Directory disk usage reporter
Copyright (C) 2005-2018 Mark Russinovich
Sysinternals - www.sysinternals.com

Files:        162
Directories:  1
Size:         109,852,612 bytes
Size on disk: 110,185,248 bytes
Copy

Listing 49 - Checking C: disk usage

A close inspection of Listing 49 will reveal that
the actual Size of our disk usage is somehow lower than the drive's
Size on disk. This latter attribute represents the total number of
bytes that's taken up by a file or directory; in this case, the entire
C: drive.

The reason that Size on disk can be larger than Size is that
when a file is created under NTFS, it is allocated a particular set
of clusters.^[158] Even if a file takes up
X units of space, it will be allocated the full size of whatever
clusters it needs to fit inside. For a simple example, imagine that
our file system is set up to store data in 512-byte clusters. If we
create a file that takes up 500 bytes of space, it will still use up
the full 512 bytes of the cluster it is assigned to. Therefore, we
will usually lose a small amount of space on each file allocation.

We can also use du to analyze space usage of a supplied
directory:

C:\Users\Offsec\Downloads\SysinternalsSuite>du c:\users

DU v1.62 - Directory disk usage reporter
Copyright (C) 2005-2018 Mark Russinovich
Sysinternals - www.sysinternals.com

Files:        90740
Directories:  14739
Size:         84,302,189,204 bytes
Size on disk: 84,716,127,000 bytes
Copy

Listing 50 - Checking C:\users disk usage

Note again how Size on disk is greater than Size.

Let's finish this section by returning to one of the first Windows commands
we learned, dir. Now that we know a little bit more about NTFS,
we can consider the dir /R option which is useful for identifying
Alternate Data Streams (ADS).

A stream is a property of files under NTFS that essentially allows
us to store content within arbitrary sections of the file. When we
create a new file, the content is stored in the default data stream.
When we want to retrieve the contents (say, with type), we will read
from that default stream.

ADS allows files to contain multiple data streams. We can place
content in a new data stream with the :<stream> syntax
using echo:

C:\streamtest>echo fileOne uses the default stream > defaultStream.txt

C:\streamtest>echo fileTwo uses the 'offsec' stream > offsecStream.txt:offsec

C:\streamtest>type defaultStream.txt
fileOne uses the default stream

C:\streamtest>type offsecStream.txt

C:\streamtest>dir
 Volume in drive C has no label.
 Volume Serial Number is 523D-9369

 Directory of C:\streamtest

2021-06-03  03:39 PM    <DIR>          .
2021-06-03  03:39 PM    <DIR>          ..
2021-06-03  03:38 PM                34 defaultStream.txt
2021-06-03  03:39 PM                 0 offsecStream.txt
               2 File(s)             34 bytes
               2 Dir(s)  31,895,818,240 bytes free
Copy

Listing 51 - Experimenting with Alternate Data Streams

In Listing 51, we first create two files. The first
uses the default stream, and the second uses an arbitrary stream
that we've named offsec. When we use type to list
the contents of the files, we output defaultStream.txt
as expected, yet offsecStream.txt appears to be empty. In
addition, dir reports that offsecStream.txt contains
0 bytes of data.

This is where the /R options comes in. We can use
dir /R to view if any files in the directory make use of
alternate data streams:

C:\streamtest>dir /r
 Volume in drive C has no label.
 Volume Serial Number is 523D-9369

 Directory of C:\streamtest

2021-06-03  03:39 PM    <DIR>          .
2021-06-03  03:39 PM    <DIR>          ..
2021-06-03  03:38 PM                34 defaultStream.txt
2021-06-03  03:39 PM                 0 offsecStream.txt
                                    35 offsecStream.txt:offsec:$DATA
               2 File(s)             34 bytes
               2 Dir(s)  31,939,903,488 bytes free
Copy

Listing 52 - Using dir /r to view alternate data streams

Interesting, dir still reports the total space usage to
be 34 bytes; this result does not include the 35 bytes belonging to
offsecStream.txt. We can once again use du to view
the true disk usage:

C:\Users\Offsec\Downloads\SysinternalsSuite>du c:\streamtest

DU v1.62 - Directory disk usage reporter
Copyright (C) 2005-2018 Mark Russinovich
Sysinternals - www.sysinternals.com

Files:        2
Directories:  1
Size:         69 bytes
Size on disk: 12,328 bytes
Copy

Listing 53 - Using du to check alternate data stream usage

We might expect syntax like type offsecStream.txt:offsec to
output the contents of an ADS, but unfortunately, it does not:

C:\streamtest>type offsecStream.txt:offsec
The filename, directory name, or volume label syntax is incorrect.

Copy

Listing 54 - Trying to view ADS content with type

However, we can use the more command with a similar syntax:

C:\streamtest>more < offsecStream.txt:offsec
fileTwo uses the 'offsec' stream
Copy

Listing 55 - Using more to view ADS content

Note that we had to use the "<" character in Listing
55 to pass the contents of offsecStream.txt
to standard input first, and then to redirect it to more.
This is because passing an ADS directly to more does not work
either:

C:\streamtest>more offsecStream.txt:offsec
Cannot access file C:\streamtest\offsecStream.txt:offsec
Copy

Listing 56 - Trying to view ADS content directly with more

Although ADS is leveraged by Windows and other programs for benevolent
reasons, from a security perspective, ADS is important because malware
or sensitive information can be hidden inside files. The dir /r
option as well as the Sysinternals tool streams^[159]
allow us to detect ADS usage.

Windows Basics I & II: Cumulative Exercise

This Learning Unit has the following Learning Objectives:

1. Demonstrate competency with account creation on Windows
2. Demonstrate competency with running Windows binaries
3. Demonstrate competency with finding, identifying, and ending tasks
   on Windows machines
4. Demonstrate competency with manipulating the Windows Registry

This is a cumulative exercise that requires you to employ the
understanding and skills you have gained in the Windows Basics I & II
Modules to complete a set of objectives.

Scenario: You have gained initial access to a target Windows
machine during a penetration test. You now need to collect and
extract the user files from that box for further analysis and enable
persistence on the box in the form of adding an additional
administrative user. You've then been tasked by the client to analyze
the machine concerning some strange behavior they've noticed.

Though you have remote desktop access to the target machine, we
encourage using cmd.exe as much as possible in order to get the
most out of this exercise.

Networking Fundamentals

In this Module, we will cover the following Learning Units:

• The OSI Model
• The TCP/IP Model
• Network Protocols
• Data Packets and Analysis - I
• Data Packets and Analysis - II
• TCP/IP Helper Protocols
• Useful Network Technologies

Each learner moves at their own pace, but this Module should take
approximately 11 hours to complete.

Computer Networks^[160] are a vital part of our everyday life. It is
important for penetration testers and other security professionals
to familiarize themselves with the basic concepts and building blocks
of computer networks. This is because the act of hacking a target or
set of targets usually (though not always) begins at the only place
an attacker has access: their own remote machine. From there, they
often need to use and abuse their understanding of networks to gather
information, discover vulnerabilities and weaknesses, and ultimately
gain remote access to their target.

A solid understanding of networking can also help testers with the
administrative side of penetration testing. For example, during a
pricing and scoping meeting for a security assessment, it is essential
that the client and the tester can describe and agree upon exactly
what parts of a network should, and should not, be tested.

In this Module, we will begin with describing the OSI^[161] and
TCP/IP^[162] conceptual models as well as the difference between
stateful and stateless connections. We'll also spend some time on the
TCP three-way handshake concept of network traffic.

Once we've done that, we'll describe the basic concept of network
traffic and analyze packet captures^[163] with tools like Wireshark
and Tcpdump.

Finally, we'll learn about useful networking technologies, including
routing tables, firewalls, Network Address Translation (NAT), and
Virtual Private Networks (VPNs).

The OSI Model

This Learning Unit covers the following Learning Objectives:

1. Understand the difference between a conceptual network model and a
   physical implementation
2. Recall the seven layers of the OSI network model
3. Begin to understand the concept of encapsulation

This Learning Unit will take approximately 60 minutes.

Since networking is a fairly complex topic, it helps to distinguish
between how networks might be designed in theory versus how they are
implemented in the real world.

A network model is a conceptual framework that helps us understand
how we could organize communication between different devices.
Studying network models can give us a high-level understanding of what
computers are doing across networks even though, in practice, physical
implementations are not so clearly defined. Once we understand network
models, we can implement various network protocols,^[164] which
describe how two or more entities (in this case, machines) should
communicate in practice.

There are two main reference models which describe how to connect
multiple devices. These two reference models are the OSI model
(Open Systems Interconnection) and the TCP/IP model. These
conceptual models can help security professionals understand where
different security controls are (or are not) installed.